Falhas do tipo CWE-400

2.994 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2017-16098—charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down oEPSS 1.7%CVE-2022-31018HIGHDenial of service binding form from JSON in Play FrameworkEPSS 1.7%CVE-2021-41145HIGHFreeSWITCH susceptible to Denial of Service via SIP floodingEPSS 1.7%CVE-2021-29471LOWDenial of service in Matrix SynapseEPSS 1.6%CVE-2019-1672MEDIUMCisco Web Security Appliance Decryption Policy Bypass VulnerabilityEPSS 1.6%CVE-2023-31418HIGHElasticsearch uncontrolled resource consumptionEPSS 1.6%CVE-2023-32013MEDIUMWindows Hyper-V Denial of Service VulnerabilityEPSS 1.6%CVE-2022-31173HIGHJuniper is vulnerable to @DOS GraphQL Nested Fragments overflowEPSS 1.6%CVE-2022-40150MEDIUMStack Buffer Overflow in JettisonEPSS 1.6%CVE-2025-13836MEDIUMExcessive read buffering DoS in http.clientEPSS 1.6%CVE-2022-35923HIGHInefficient Regular Expression Complexity in v8nEPSS 1.6%CVE-2019-19343—A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4. A memory leak in HttpOpenListener dueEPSS 1.6%CVE-2022-31073MEDIUMKubeEdge Edge ServiceBus module DoSEPSS 1.6%CVE-2022-44570—A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range headEPSS 1.6%CVE-2021-32832MEDIUMReDOS in Rocket.ChatEPSS 1.6%CVE-2022-44572—A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an aEPSS 1.6%CVE-2024-26141MEDIUMPossible DoS Vulnerability with Range Header in RackEPSS 1.6%CVE-2023-23009MEDIUMLibreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrEPSS 1.6%CVE-2022-24741LOWHigh memory usage in Nextcloud serverEPSS 1.6%CVE-2021-29509HIGHKeepalive Connections Causing Denial Of Service in pumaEPSS 1.6%