Falhas do tipo CWE-400

3.447 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2022-31054HIGHUses of deprecated API can be used to cause DoS in user-facing endpoints in Argo EventsEPSS 1.6%CVE-2025-49716HIGHWindows Netlogon Denial of Service VulnerabilityEPSS 1.6%CVE-2017-16098—charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down oEPSS 1.6%CVE-2019-19343—A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4. A memory leak in HttpOpenListener dueEPSS 1.6%CVE-2021-29469MEDIUMPotential exponential regex in monitor modeEPSS 1.6%CVE-2022-44570—A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range headEPSS 1.6%CVE-2021-32832MEDIUMReDOS in Rocket.ChatEPSS 1.6%CVE-2022-44572—A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an aEPSS 1.6%CVE-2024-26141MEDIUMPossible DoS Vulnerability with Range Header in RackEPSS 1.6%CVE-2022-20760HIGHCisco Adaptive Security Appliance Software and Firepower Threat Defense Software DNS Inspection Denial of Service VulnerabilityEPSS 1.6%CVE-2025-53645HIGHZimbra Collaboration (ZCS) before 9.0.0 Patch 46, 10.0.x before 10.0.15, and 10.1.x before 10.1.9 is vulnerable to a denial of service condiEPSS 1.6%CVE-2022-29225HIGHZip bomb vulnerability in EnvoyEPSS 1.6%CVE-2023-23009MEDIUMLibreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrEPSS 1.6%CVE-2022-24741LOWHigh memory usage in Nextcloud serverEPSS 1.6%CVE-2021-24893—Stars Rating < 3.5.1 - Comments Denial of ServiceEPSS 1.6%CVE-2022-31110MEDIUMDenial of Service (DoS) vulnerability in RSSHubEPSS 1.6%CVE-2021-29509HIGHKeepalive Connections Causing Denial Of Service in pumaEPSS 1.6%CVE-2022-38371HIGHA vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (EPSS 1.6%CVE-2020-6986HIGHIn all versions of Omron PLC CJ Series, an attacker can send a series of specific data packets within a short period, causing a service erroEPSS 1.6%CVE-2022-24726HIGHUnauthenticated control plane denial of service attack in IstioEPSS 1.6%