Fallos del tipo CWE-407

270 resultados

Complexidade algorítmica ineficiente

É quando o código usa um algoritmo cuja complexidade computacional cresce desproporcionalmente com o tamanho da entrada, permitindo que um atacante consuma recursos (CPU, memória, tempo) enviando dados malformados ou massivos. O perigo: negação de serviço (DoS) ou travamento da aplicação sem necessidade de exploração de bugs clássicos.

Ejemplo

Uma API que processa lista de usuários com dois loops aninhados (O(n²)) em vez de usar hash ou índice. Um atacante envia 10 mil usuários e a operação que demoraria milissegundos passa a levar minutos, derrubando o servidor.

Cómo mitigar

Escolha algoritmos eficientes (use estruturas de dados apropriadas: hash, árvores balanceadas); implemente limites de entrada (validar tamanho máximo de listas, strings); monitore tempo de execução e aborte operações que excedem threshold; teste performance com dados grandes durante development.

CVE-2026-71848MEDIUMHono: Algorithmic Complexity DoS in Language MiddlewareEPSS 0.5%CVE-2026-45822MEDIUMdecode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and callEPSS 0.5%CVE-2026-42772MEDIUMPotential CPU DoS via O(n^2) Fragment Reassembly in QUICEPSS 0.5%CVE-2026-34827HIGHRack: Algorithmic-Complexity DoS in Rack::Multipart::ParserEPSS 0.5%CVE-2026-86428HIGHcommonmark 1.5.0 before 2.10.0 Denial of Service via AttributesEPSS 0.5%CVE-2026-58059HIGHQuadratic-time escaping when stringifying X.500 distinguished namesEPSS 0.5%CVE-2026-86430HIGHleague/commonmark before 2.9.1 Denial of Service via parsingEPSS 0.5%CVE-2026-86435HIGHcommonmark 1.5.0 before 2.8.4 Denial of Service via FootnoteEPSS 0.5%CVE-2024-58382HIGHleague/commonmark before 2.6.0 Denial of Service via Quadratic ComplexityEPSS 0.5%CVE-2026-73643HIGHjs-yaml: Exponential parsing time in the flow collections leads to denial of serviceEPSS 0.5%CVE-2026-3988HIGHInefficient Algorithmic Complexity in GitLabEPSS 0.5%CVE-2026-3276MEDIUMPotential DoS via quadratic complexity in unicodedata.normalize()EPSS 0.5%CVE-2026-110688HIGHCpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parseEPSS 0.5%CVE-2026-84429MEDIUMPotential denial-of-service vulnerability in HTTP header parsingEPSS 0.5%CVE-2026-65623HIGHQuadratic CPU blow-up reassembling fragmented WebSocket messages in BanditEPSS 0.5%CVE-2026-19668MEDIUMResource Exhaustion via Excessive DNSSEC Cryptographic Material MatchingEPSS 0.5%CVE-2026-45186LOWIn libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crEPSS 0.5%CVE-2026-69184HIGHc-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chainsEPSS 0.5%CVE-2026-116133HIGHHTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundaryEPSS 0.5%CVE-2026-114141HIGHtoml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()EPSS 0.5%