Falhas do tipo CWE-400

3.438 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2021-41186MEDIUMReDoS vulnerability in parser_apache2EPSS 2.2%CVE-2024-38149HIGHBranchCache Denial of Service VulnerabilityEPSS 2.2%CVE-2020-14340—A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage colEPSS 2.2%CVE-2016-9367HIGHAn issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions pEPSS 2.2%CVE-2020-11090HIGHUncontrolled Resource Consumption in Indy NodeEPSS 2.2%CVE-2025-23184MEDIUMApache CXF: Denial of Service vulnerability with temporary filesEPSS 2.2%CVE-2021-22965—A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a denial of service when a maEPSS 2.2%CVE-2025-21174HIGHWindows Standards-Based Storage Management Service Denial of Service VulnerabilityEPSS 2.2%CVE-2020-8185—A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app runniEPSS 2.2%CVE-2019-12625HIGHClamAV Zip Bomb VulnerabilityEPSS 2.2%CVE-2020-3131MEDIUMCisco Webex Teams Adaptive Cards Denial of Service VulnerabilityEPSS 2.2%CVE-2025-38501HIGHksmbd: limit repeated connections from clients with the same IPEPSS 2.2%CVE-2019-14888HIGHA vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPEPSS 2.2%CVE-2020-26289HIGHRegular expression Denial of Service in date-and-timeEPSS 2.2%CVE-2018-14659MEDIUMThe Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GF_XATTR_IOSTATS_DUMP_KEPSS 2.2%CVE-2021-21294HIGHUnbounded connection acceptance in http4s-blaze-serverEPSS 2.2%CVE-2022-24839HIGHUncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork)EPSS 2.2%CVE-2021-21274MEDIUMDenial of service attack via .well-known lookupsEPSS 2.2%CVE-2025-27485HIGHWindows Standards-Based Storage Management Service Denial of Service VulnerabilityEPSS 2.2%CVE-2025-27486HIGHWindows Standards-Based Storage Management Service Denial of Service VulnerabilityEPSS 2.2%