Falhas do tipo CWE-1050
17 resultadosConsumo excessivo de recursos da plataforma em loop
Fraqueza onde código dentro de um laço realiza operações pesadas (alocação de memória, I/O, cálculos intensivos) sem limite, esgotando recursos do sistema. Um atacante ou situação adversa provoca execução repetida até travamento, consumo total de memória, ou negação de serviço.
Exemplo
Um endpoint web que processa lista de URLs recebida do usuário, abrindo conexão com cada URL dentro de um loop sem limite de tempo ou pool de conexões. Atacante envia 100 mil URLs, esgota sockets do servidor e mata a aplicação.
Como mitigar
Implemente limites explícitos: limite de iterações, timeout por operação, pool de recursos reutilizáveis (connection pooling), rate limiting. Use memória pré-alocada ou monitore crescimento. Teste carga com entrada adversarial.
CVE-2023-1390HIGHA remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknEPSS 5.1%CVE-2019-11254MEDIUMKubernetes API Server denial of service vulnerability from malicious YAML payloadsEPSS 3.1%CVE-2024-4068HIGHMemory Exhaustion in bracesEPSS 1.5%CVE-2021-41039—In versions 1.6 to 2.0.11 of Eclipse Mosquitto, an MQTT v5 client connecting with a large number of user-property properties could cause excEPSS 1.3%CVE-2025-48866HIGHModSecurity has possible DoS vulnerability in sanitiseArg actionEPSS 0.8%CVE-2026-48779HIGHws: Memory exhaustion DoS from tiny fragments and data chunksEPSS 0.8%CVE-2026-41292MEDIUMLong list of incoming EDNS options degrades performanceEPSS 0.7%CVE-2025-32907MEDIUMLibsoup: denial of service in server when client requests a large amount of overlapping ranges with range headerEPSS 0.7%CVE-2026-44390MEDIUMUnbounded name compression in certain cases causes degradation of serviceEPSS 0.6%CVE-2025-47947HIGHModSecurity Has Possible DoS VulnerabilityEPSS 0.6%CVE-2026-4634HIGHKeycloak: keycloak: denial of service via excessive processing of openid connect scope parametersEPSS 0.5%CVE-2026-81736HIGHRemote CPU denial of service through cached SVCB/HTTPS AliasMode treesEPSS 0.5%CVE-2026-22263MEDIUMSuricata http1: quadratic complexity in headers parsing over multiple packetsEPSS 0.4%CVE-2026-71488HIGHleague/commonmark: Quadratic-time denial of service when parsing crafted MarkdownEPSS 0.3%CVE-2025-67419HIGHA Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resEPSS 0.3%CVE-2026-22261LOWSuricata eve/alert: http1 xff handling can lead to denial of serviceEPSS 0.3%CVE-2026-52681LOWSieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedlyEPSS 0.3%