Falhas do tipo CWE-400

3.447 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2019-10936HIGHAffected devices improperly handle large amounts of specially crafted UDP packets. This could allow an unauthenticated remote attacker toEPSS 2.1%CVE-2024-35176MEDIUMREXML contains a denial of service vulnerabilityEPSS 2.1%CVE-2015-9241—Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sEPSS 2.1%CVE-2023-31418HIGHElasticsearch uncontrolled resource consumptionEPSS 2.1%CVE-2025-26680HIGHWindows Standards-Based Storage Management Service Denial of Service VulnerabilityEPSS 2.0%CVE-2018-16470—There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parseEPSS 2.0%CVE-2023-21728HIGHWindows Netlogon Denial of Service VulnerabilityEPSS 2.0%CVE-2021-21296LOWDenial-of-service in FleetEPSS 2.0%CVE-2015-9242—Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. ThEPSS 2.0%CVE-2022-40617HIGHstrongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and iEPSS 2.0%CVE-2020-3254HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Media Gateway Control Protocol Denial of Service VulnerabilitiesEPSS 2.0%CVE-2018-15388HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software WebVPN Denial of Service VulnerabilityEPSS 2.0%CVE-2019-12698MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software WebVPN CPU Denial of Service VulnerabilityEPSS 2.0%CVE-2021-43843MEDIUMInsufficient patch for Regular Expression Denial of Service (ReDoS) to jsx-slack v4.5.1EPSS 2.0%CVE-2020-3373HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software IP Fragment Memory Leak VulnerabilityEPSS 2.0%CVE-2025-21389HIGHWindows Universal Plug and Play (UPnP) Device Host Denial of Service VulnerabilityEPSS 2.0%CVE-2019-12658HIGHCisco IOS XE Software Filesystem Exhaustion Denial of Service VulnerabilityEPSS 2.0%CVE-2023-37379—Apache Airflow: Exposure of sensitive connection information, DOS and SSRF on "test connection" featureEPSS 2.0%CVE-2020-36320HIGHRegular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7EPSS 2.0%CVE-2018-0309—A vulnerability in the implementation of a specific CLI command and the associated Simple Network Management Protocol (SNMP) MIB for Cisco NEPSS 1.9%