Falhas do tipo CWE-400

3.432 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2024-49075HIGHWindows Remote Desktop Services Denial of Service VulnerabilityEPSS 2.6%CVE-2024-30019MEDIUMDHCP Server Service Denial of Service VulnerabilityEPSS 2.6%CVE-2019-1737HIGHCisco IOS and IOS XE Software IP Service Level Agreement Denial of Service VulnerabilityEPSS 2.6%CVE-2020-12667HIGHKnot Resolver before 5.1.1 allows traffic amplification via a crafted DNS answer from an attacker-controlled server, aka an "NXNSAttack" issEPSS 2.6%CVE-2021-27385HIGHA vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 UpdatEPSS 2.6%CVE-2009-3791HIGHUnspecified vulnerability in Adobe Flash Media Server (FMS) before 3.5.3 allows attackers to cause a denial of service (resource exhaustion)EPSS 2.6%CVE-2023-38178HIGH.NET Core and Visual Studio Denial of Service VulnerabilityEPSS 2.6%CVE-2026-23864HIGHMultiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, reacEPSS 2.6%CVE-2025-27469HIGHWindows Lightweight Directory Access Protocol (LDAP) Denial of Service VulnerabilityEPSS 2.6%CVE-2025-21300HIGHWindows Universal Plug and Play (UPnP) Device Host Denial of Service VulnerabilityEPSS 2.6%CVE-2016-8627MEDIUMadmin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that allows logs to be availEPSS 2.6%CVE-2023-5870LOWPostgresql: role pg_signal_backend can signal certain superuser processes.EPSS 2.6%CVE-2021-1312MEDIUMCisco Elastic Services Controller Denial of Service VulnerabilityEPSS 2.6%CVE-2017-15130—A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI confEPSS 2.6%CVE-2024-21342HIGHWindows DNS Client Denial of Service VulnerabilityEPSS 2.5%CVE-2018-8854—Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not properly restrict the size or amount of resources rEPSS 2.5%CVE-2023-36703HIGHDHCP Server Service Denial of Service VulnerabilityEPSS 2.5%CVE-2024-38031HIGHWindows Online Certificate Status Protocol (OCSP) Server Denial of Service VulnerabilityEPSS 2.5%CVE-2024-38067HIGHWindows Online Certificate Status Protocol (OCSP) Server Denial of Service VulnerabilityEPSS 2.5%CVE-2024-38068HIGHWindows Online Certificate Status Protocol (OCSP) Server Denial of Service VulnerabilityEPSS 2.5%