Falhas do tipo CWE-400

2.985 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2025-21231HIGHIP Helper Denial of Service VulnerabilityEPSS 2.6%CVE-2025-21251HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 2.6%CVE-2023-38178HIGH.NET Core and Visual Studio Denial of Service VulnerabilityEPSS 2.6%CVE-2025-21218HIGHWindows Kerberos Denial of Service VulnerabilityEPSS 2.6%CVE-2021-27385HIGHA vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 UpdatEPSS 2.6%CVE-2023-5870LOWPostgresql: role pg_signal_backend can signal certain superuser processes.EPSS 2.6%CVE-2017-15130—A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI confEPSS 2.6%CVE-2024-21342HIGHWindows DNS Client Denial of Service VulnerabilityEPSS 2.5%CVE-2025-21300HIGHWindows Universal Plug and Play (UPnP) Device Host Denial of Service VulnerabilityEPSS 2.5%CVE-2021-1312MEDIUMCisco Elastic Services Controller Denial of Service VulnerabilityEPSS 2.5%CVE-2018-8854—Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not properly restrict the size or amount of resources rEPSS 2.5%CVE-2024-38067HIGHWindows Online Certificate Status Protocol (OCSP) Server Denial of Service VulnerabilityEPSS 2.5%CVE-2024-38068HIGHWindows Online Certificate Status Protocol (OCSP) Server Denial of Service VulnerabilityEPSS 2.5%CVE-2024-38031HIGHWindows Online Certificate Status Protocol (OCSP) Server Denial of Service VulnerabilityEPSS 2.5%CVE-2021-21317MEDIUMDenial of Service in uap-coreEPSS 2.5%CVE-2018-14660MEDIUMA flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GF_META_LOCK_KEY xattr. A remote, authEPSS 2.5%CVE-2018-0372—A vulnerability in the DHCPv6 feature of the Cisco Nexus 9000 Series Fabric Switches in Application-Centric Infrastructure (ACI) Mode could EPSS 2.5%CVE-2026-27308LOWColdFusion | Uncontrolled Resource Consumption (CWE-400)EPSS 2.5%CVE-2020-24686HIGHAC500 V2 webserver denial of service vulnerabilityEPSS 2.5%CVE-2025-21351HIGHWindows Active Directory Domain Services API Denial of Service VulnerabilityEPSS 2.5%