Falhas do tipo CWE-400

3.447 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2023-42669MEDIUMSamba: "rpcecho" development server allows denial of service via sleep() call on ad dcEPSS 1.9%CVE-2024-54677MEDIUMApache Tomcat: DoS in examples web applicationEPSS 1.9%CVE-2023-28217HIGHWindows Network Address Translation (NAT) Denial of Service VulnerabilityEPSS 1.9%CVE-2019-5472—An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and maintainer to delete epEPSS 1.9%CVE-2022-40899HIGHAn issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-CookieEPSS 1.9%CVE-2024-2757HIGHPHP mb_encode_mimeheader runs endlessly for some inputsEPSS 1.9%CVE-2025-24211CRITICALThis issue was addressed with improved memory handling. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, EPSS 1.9%CVE-2025-24190CRITICALThe issue was addressed with improved memory handling. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, mEPSS 1.9%CVE-2022-35922HIGHMemory allocation based on untrusted length in rust-websocketEPSS 1.9%CVE-2020-3196HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software SSL/TLS Denial of Service VulnerabilityEPSS 1.9%CVE-2020-3195HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software OSPF Packets Processing Memory Leak VulnerabilityEPSS 1.9%CVE-2025-32724HIGHWindows Local Security Authority Subsystem Service (LSASS) Denial of Service VulnerabilityEPSS 1.9%CVE-2025-33068HIGHWindows Standards-Based Storage Management Service Denial of Service VulnerabilityEPSS 1.9%CVE-2018-10924MEDIUMIt was discovered that fsync(2) system call in glusterfs client code leaks memory. An authenticated attacker could use this flaw to launch aEPSS 1.9%CVE-2021-39229HIGHRegular expression deinal of service in appriseEPSS 1.9%CVE-2023-24534HIGHExcessive memory allocation in net/http and net/textprotoEPSS 1.9%CVE-2020-12516HIGHWAGO: PLC families 750-88x and 750-352 prone to DoS attackEPSS 1.9%CVE-2020-26264MEDIUMLES Server DoS via GetProofsV2EPSS 1.9%CVE-2023-35339HIGHWindows CryptoAPI Denial of Service VulnerabilityEPSS 1.9%CVE-2022-24294—ReDoS in Apache MXNet RTC ModuleEPSS 1.9%