Falhas do tipo CWE-400

3.438 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2025-21289HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 2.4%CVE-2025-21290HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 2.4%CVE-2019-6559—Moxa IKS and EDS allow remote authenticated users to cause a denial of service via a specially crafted packet, which may cause the switch toEPSS 2.4%CVE-2024-21386HIGH.NET Denial of Service VulnerabilityEPSS 2.4%CVE-2016-10523—MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS attack feasible witEPSS 2.4%CVE-2024-38015HIGHWindows Remote Desktop Gateway (RD Gateway) Denial of Service VulnerabilityEPSS 2.4%CVE-2020-26257MEDIUMDenial of service attack via incorrect parameters to federation APIsEPSS 2.4%CVE-2026-34473HIGHUnauthenticated DoS in ZTE H8102E, H168N, H167A, H199A, H288A, H198A, H267A, H267N, H268A, H388X, H196A, H369A, H268N, H208N, H367N, H181A, EPSS 2.4%CVE-2018-0230—A vulnerability in the internal packet-processing functionality of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 SeEPSS 2.4%CVE-2020-5236MEDIUMCatastrophic backtracking in regex allows Denial of Service in WaitressEPSS 2.4%CVE-2022-21670MEDIUMUncontrolled Resource Consumption in markdown-itEPSS 2.4%CVE-2025-27470HIGHWindows Standards-Based Storage Management Service Denial of Service VulnerabilityEPSS 2.4%CVE-2025-26652HIGHWindows Standards-Based Storage Management Service Denial of Service VulnerabilityEPSS 2.4%CVE-2018-0233—A vulnerability in the Secure Sockets Layer (SSL) packet reassembly functionality of the detection engine in Cisco Firepower System SoftwareEPSS 2.4%CVE-2006-6017MEDIUMWordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote authEPSS 2.3%CVE-2021-32839HIGHRegular Expression Denial of Service in sqlparseEPSS 2.3%CVE-2021-3670—MaxQueryDuration not honoured in Samba AD DC LDAPEPSS 2.3%CVE-2018-1114MEDIUMIt was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file deEPSS 2.3%CVE-2024-43575HIGHWindows Hyper-V Denial of Service VulnerabilityEPSS 2.3%CVE-2024-43541HIGHMicrosoft Simple Certificate Enrollment Protocol Denial of Service VulnerabilityEPSS 2.3%