Falhas do tipo CWE-400

3.450 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2019-13926—A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCAEPSS 1.5%CVE-2022-39158MEDIUMA vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC,EPSS 1.5%CVE-2022-38150MEDIUMIn Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to assert and automatically restart through forgEPSS 1.5%CVE-2021-47295HIGHnet: sched: fix memory leak in tcindex_partial_destroy_workEPSS 1.5%CVE-2020-8136—Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests bEPSS 1.5%CVE-2024-39908MEDIUMDenial of service in REXMLEPSS 1.5%CVE-2018-16487—A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into EPSS 1.5%CVE-2020-27295—The affected product has uncontrolled resource consumption issues, which may allow an attacker to cause a denial-of-service condition on theEPSS 1.5%CVE-2020-14522HIGHSofting Industrial Automation OPCEPSS 1.5%CVE-2017-16113—The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed.EPSS 1.5%CVE-2018-16486—A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prEPSS 1.5%CVE-2017-16115—The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the evEPSS 1.5%CVE-2025-29954MEDIUMWindows Lightweight Directory Access Protocol (LDAP) Denial of Service VulnerabilityEPSS 1.5%CVE-2024-4068HIGHMemory Exhaustion in bracesEPSS 1.5%CVE-2022-2455MEDIUMA business logic issue in the handling of large repositories in all versions of GitLab CE/EE from 10.0 before 15.1.6, all versions starting EPSS 1.5%CVE-2023-0662HIGHDoS vulnerability when parsing multipart request bodyEPSS 1.5%CVE-2018-6335HIGHA Malformed h2 frame can cause 'std::out_of_range' exception when parsing priority meta data. This behavior can lead to denial-of-service. TEPSS 1.5%CVE-2026-19446HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 1.5%CVE-2019-13946HIGHProfinet-IO (PNIO) stack versions prior V06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic packagEPSS 1.5%CVE-2022-36064MEDIUMShescape Inefficient Regular Expression Complexity vulnerabilityEPSS 1.5%