Falhas do tipo CWE-400

3.447 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2020-8295—A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user.EPSS 1.8%CVE-2023-6277MEDIUMLibtiff: out-of-memory in tiffopen via a craft fileEPSS 1.8%CVE-2023-35329MEDIUMWindows Authentication Denial of Service VulnerabilityEPSS 1.8%CVE-2021-32657MEDIUMMalicious user could break user administration pageEPSS 1.8%CVE-2022-41404HIGHAn issue in the fetch() method in the BasicProfile class of org.ini4j through version v0.5.4 allows attackers to cause a Denial of Service (EPSS 1.8%CVE-2021-21254MEDIUMRegular expression Denial of Service in Markdown pluginEPSS 1.8%CVE-2025-26677HIGHWindows Remote Desktop Gateway (RD Gateway) Denial of Service VulnerabilityEPSS 1.8%CVE-2019-1696HIGHCisco Firepower Threat Defense Software SMB Protocol Preprocessor Detection Engine Denial of Service VulnerabilitiesEPSS 1.8%CVE-2020-3572HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software SSL/TLS Session Denial of Service VulnerabilityEPSS 1.8%CVE-2021-21419MEDIUMImproper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventletEPSS 1.8%CVE-2014-2342—Triangle MicroWorks SCADA Data Gateway Resource ExhaustionEPSS 1.8%CVE-2026-45769HIGHikev2: unbounded client transform storage can lead to resource exhaustionEPSS 1.8%CVE-2020-3533HIGHCisco Firepower Threat Defense Software SNMP Denial of Service VulnerabilityEPSS 1.8%CVE-2023-35298HIGHHTTP.sys Denial of Service VulnerabilityEPSS 1.8%CVE-2021-3690—A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attackEPSS 1.8%CVE-2019-3874MEDIUMThe SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use this flaw to cause a dEPSS 1.8%CVE-2023-21543HIGHWindows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution VulnerabilityEPSS 1.8%CVE-2024-23443MEDIUMA high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously craftedEPSS 1.8%CVE-2022-35923HIGHInefficient Regular Expression Complexity in v8nEPSS 1.8%CVE-2021-21271MEDIUMDenial of service in TenderMint CoreEPSS 1.8%