Falhas do tipo CWE-400

3.447 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2019-12700HIGHCisco FTD, FMC, and FXOS Software Pluggable Authentication Module Denial of Service VulnerabilityEPSS 1.9%CVE-2017-16025—Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vuEPSS 1.9%CVE-2024-12254HIGHUnbounded memory buffering in SelectorSocketTransport.writelines()EPSS 1.9%CVE-2021-32823LOWPotential Denial-of-Service in bindataEPSS 1.9%CVE-2021-32838HIGHRegular Expression Denial of Service in flask-restxEPSS 1.9%CVE-2020-3255HIGHCisco Firepower Threat Defense Software Packet Flood Denial of Service VulnerabilityEPSS 1.9%CVE-2020-3189HIGHCisco Firepower Threat Defense Software VPN System Logging Denial of Service VulnerabilityEPSS 1.9%CVE-2017-16118—The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression deniEPSS 1.9%CVE-2017-15133—A denial of service flaw was found in miekg-dns before 1.0.4. A remote attacker could use carefully timed TCP packets to block the DNS serveEPSS 1.9%CVE-2026-46522HIGHImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustionEPSS 1.8%CVE-2020-3529HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software SSL VPN Direct Memory Access Denial of Service VulnerabilityEPSS 1.8%CVE-2018-10935MEDIUMA flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort.EPSS 1.8%CVE-2026-72923HIGHMicrosoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansionEPSS 1.8%CVE-2018-15399—Cisco Adaptive Security Appliance TCP Syslog Denial of Service VulnerabilityEPSS 1.8%CVE-2022-1210MEDIUMLibTIFF tiff2ps resource consumptionEPSS 1.8%CVE-2021-21328MEDIUMDenial of ServiceEPSS 1.8%CVE-2018-16489—A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through itEPSS 1.8%CVE-2023-0056MEDIUMAn uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenEPSS 1.8%CVE-2021-29430HIGHDenial of service attack via memory exhaustionEPSS 1.8%CVE-2023-27530HIGHA DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could alEPSS 1.8%