Falhas do tipo CWE-400

3.400 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2026-27307LOWColdFusion | Uncontrolled Resource Consumption (CWE-400)EPSS 2.7%CVE-2025-26673HIGHWindows Lightweight Directory Access Protocol (LDAP) Denial of Service VulnerabilityEPSS 2.7%CVE-2025-21230HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 2.7%CVE-2018-14626MEDIUMPowerDNS Authoritative Server 4.1.0 up to 4.1.4 inclusive and PowerDNS Recursor 4.0.0 up to 4.1.4 inclusive are vulnerable to a packet cacheEPSS 2.7%CVE-2021-20201—A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers to cause a denial of service (CPUEPSS 2.7%CVE-2024-38168HIGH.NET and Visual Studio Denial of Service VulnerabilityEPSS 2.7%CVE-2015-1916HIGHUnspecified vulnerability in IBM Java 8 before SR1 allows remote attackers to cause a denial of service via unknown vectors related to SSL/TEPSS 2.7%CVE-2022-21681HIGHExponential catastrophic backtracking (ReDoS) in markedEPSS 2.7%CVE-2020-3554HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Denial of Service VulnerabilityEPSS 2.7%CVE-2024-26215HIGHDHCP Server Service Denial of Service VulnerabilityEPSS 2.7%CVE-2018-4837—A vulnerability has been identified in TeleControl Server Basic < V3.1. An attacker with access to the TeleControl Server Basic's webserver EPSS 2.7%CVE-2023-28320MEDIUMA denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, seEPSS 2.7%CVE-2018-14638HIGHA flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in delete_passwdPolicy function when persistent searEPSS 2.6%CVE-2026-38361HIGHMultiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-upload handler (dash_EPSS 2.6%CVE-2018-0285—A vulnerability in service logging for Cisco Prime Service Catalog could allow an authenticated, remote attacker to deny service to the userEPSS 2.6%CVE-2017-6024—A Resource Exhaustion issue was discovered in Rockwell Automation ControlLogix 5580 controllers V28.011, V28.012, and V28.013; ControlLogix EPSS 2.6%CVE-2025-21251HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 2.6%CVE-2025-21231HIGHIP Helper Denial of Service VulnerabilityEPSS 2.6%CVE-2023-29331HIGH.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityEPSS 2.6%CVE-2025-21218HIGHWindows Kerberos Denial of Service VulnerabilityEPSS 2.6%