Falhas do tipo CWE-400

3.438 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2024-7592HIGHQuadratic complexity parsing cookies with backslashesEPSS 2.3%CVE-2024-43506HIGHBranchCache Denial of Service VulnerabilityEPSS 2.3%CVE-2024-38236HIGHDHCP Server Service Denial of Service VulnerabilityEPSS 2.3%CVE-2019-1644HIGHCisco IoT Field Network Director Resource Exhaustion Denial of Service VulnerabilityEPSS 2.3%CVE-2016-8611MEDIUMA vulnerability was found in Openstack Glance. No limits are enforced within the Glance image service for both v1 and v2 `/images` API POST EPSS 2.3%CVE-2018-0086—A vulnerability in the application server of the Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attacker tEPSS 2.3%CVE-2022-3517HIGHA vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExEPSS 2.3%CVE-2023-22795—A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially craftEPSS 2.3%CVE-2021-20216—A flaw was found in Privoxy in versions before 3.0.31. A memory leak that occurs when decompression fails unexpectedly may lead to a denial EPSS 2.3%CVE-2025-27473HIGHHTTP.sys Denial of Service VulnerabilityEPSS 2.3%CVE-2025-26641HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 2.3%CVE-2018-15464MEDIUMCisco ASR 900 Series Aggregation Services Router Software Denial of Service VulnerabilityEPSS 2.3%CVE-2024-43515HIGHInternet Small Computer Systems Interface (iSCSI) Denial of Service VulnerabilityEPSS 2.3%CVE-2023-5157HIGHMariadb: node crashes with transport endpoint is not connected mysqld got signal 6EPSS 2.3%CVE-2019-1704HIGHCisco Firepower Threat Defense Software SMB Protocol Preprocessor Detection Engine Denial of Service VulnerabilitiesEPSS 2.3%CVE-2022-26477—Denial of service in readExternal methodEPSS 2.3%CVE-2022-30122—A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.EPSS 2.2%CVE-2023-33141HIGHYet Another Reverse Proxy (YARP) Denial of Service VulnerabilityEPSS 2.2%CVE-2024-43544HIGHMicrosoft Simple Certificate Enrollment Protocol Denial of Service VulnerabilityEPSS 2.2%CVE-2024-43545HIGHWindows Online Certificate Status Protocol (OCSP) Server Denial of Service VulnerabilityEPSS 2.2%