Falhas do tipo CWE-400

3.438 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2022-1797MEDIUMRockwell Automation Logix Controllers Uncontrolled Resource ConsumptionEPSS 2.2%CVE-2022-39209HIGHUncontrolled Resource Consumption in cmark-gfmEPSS 2.2%CVE-2023-52425HIGHlibexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large toEPSS 2.1%CVE-2018-10632—In Moxa NPort 5210, 5230, and 5232 versions 2.9 build 17030709 and prior, the amount of resources requested by a malicious actor are not resEPSS 2.1%CVE-2021-21293HIGHUnbounded connection acceptance leads to file handle exhaustionEPSS 2.1%CVE-2026-33116HIGH.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityEPSS 2.1%CVE-2018-16472—A prototype pollution attack in cached-path-relative versions <=1.0.1 allows an attacker to inject properties on Object.prototype which are EPSS 2.1%CVE-2021-32740HIGHRegular Expression Denial of Service in Addressable templatesEPSS 2.1%CVE-2025-21207HIGHWindows Connected Devices Platform Service (Cdpsvc) Denial of Service VulnerabilityEPSS 2.1%CVE-2025-53506HIGHApache Tomcat: DoS via excessive h2 streams at connection startEPSS 2.1%CVE-2019-1814MEDIUMCisco Small Business 300 Series Managed Switches DHCP Denial of Service VulnerabilityEPSS 2.1%CVE-2025-46392MEDIUMApache Commons Configuration: Uncontrolled Resource Consumption when loading untrusted configurations in 1.xEPSS 2.1%CVE-2017-16138HIGHThe mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted useEPSS 2.1%CVE-2024-28176MEDIUMjose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintextEPSS 2.1%CVE-2015-9241—Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sEPSS 2.1%CVE-2021-21267HIGHRegular Expression Denial-of-Service in npm schema-inspectorEPSS 2.1%CVE-2025-21330HIGHWindows Remote Desktop Services Denial of Service VulnerabilityEPSS 2.1%CVE-2017-14028—A Resource Exhaustion issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 VersioEPSS 2.1%CVE-2021-21375MEDIUMCrash in receiving updated SDP answer after initial SDP negotiation failedEPSS 2.1%CVE-2019-7620—Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin. An unauthenticated user who isEPSS 2.1%