Falhas do tipo CWE-400

3.438 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2021-21317MEDIUMDenial of Service in uap-coreEPSS 2.5%CVE-2018-14660MEDIUMA flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GF_META_LOCK_KEY xattr. A remote, authEPSS 2.5%CVE-2018-0372—A vulnerability in the DHCPv6 feature of the Cisco Nexus 9000 Series Fabric Switches in Application-Centric Infrastructure (ACI) Mode could EPSS 2.5%CVE-2026-27308LOWColdFusion | Uncontrolled Resource Consumption (CWE-400)EPSS 2.5%CVE-2020-24686HIGHAC500 V2 webserver denial of service vulnerabilityEPSS 2.5%CVE-2018-15383—Cisco Adaptive Security Appliance Direct Memory Access Denial of Service VulnerabilityEPSS 2.5%CVE-2022-35769HIGHWindows Point-to-Point Protocol (PPP) Denial of Service VulnerabilityEPSS 2.5%CVE-2021-21306MEDIUMDenial of Service in MarkedEPSS 2.5%CVE-2022-24729MEDIUMRegular expression Denial of Service in dialog pluginEPSS 2.5%CVE-2020-7587—A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2EPSS 2.5%CVE-2023-36431HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 2.5%CVE-2023-36579HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 2.5%CVE-2026-45591HIGHASP.NET Core Denial of Service VulnerabilityEPSS 2.5%CVE-2025-21351HIGHWindows Active Directory Domain Services API Denial of Service VulnerabilityEPSS 2.5%CVE-2019-1873HIGHCisco ASA and FTD Software Cryptographic TLS and SSL Driver Denial of Service VulnerabilityEPSS 2.5%CVE-2020-8220—A denial of service vulnerability exists in Pulse Connect Secure <9.1R8 that allows an authenticated attacker to perform command injection vEPSS 2.5%CVE-2023-34462MEDIUMnetty-handler SniHandler 16MB allocationEPSS 2.5%CVE-2020-1700MEDIUMA flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by maEPSS 2.4%CVE-2022-24863HIGHDenial of service in http-swaggerEPSS 2.4%CVE-2025-21289HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 2.4%