Falhas do tipo CWE-400

3.450 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2021-29506MEDIUMNavigate endpoint is vulnerable to regex injection that may lead to Denial of Service.EPSS 1.4%CVE-2019-10923HIGHAn attacker with network access to an affected product may cause a denial of service condition by breaking the real-time synchronization (IREPSS 1.4%CVE-2021-20185—It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages,EPSS 1.4%CVE-2022-1259—A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial EPSS 1.4%CVE-2024-40634HIGHArgo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook EndpointEPSS 1.4%CVE-2020-36620LOWBrondahl EnumStringValues EnumExtensions.cs GetStringValuesWithPreferences_Uncache resource consumptionEPSS 1.4%CVE-2016-10539—negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "AEPSS 1.4%CVE-2021-22116—RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client conEPSS 1.4%CVE-2020-3571HIGHCisco Firepower 4110 ICMP Flood Denial of Service VulnerabilityEPSS 1.4%CVE-2023-43646HIGHInefficient Regular Expression Complexity in get-func-nameEPSS 1.4%CVE-2023-50967HIGHlatchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.EPSS 1.4%CVE-2023-3163LOWy_project RuoYi filterKeyword resource consumptionEPSS 1.4%CVE-2014-10064—The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply neEPSS 1.4%CVE-2020-27782—A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using querEPSS 1.4%CVE-2023-25816MEDIUMnextcloud vulnerable to Uncontrolled Resource ConsumptionEPSS 1.4%CVE-2018-6346HIGHA potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically a circular dependency). This aEPSS 1.4%CVE-2018-6347HIGHAn issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack. This affects Proxygen prior tEPSS 1.4%CVE-2021-21236MEDIUMRegular Expression Denial of Service in CairoSVGEPSS 1.4%CVE-2020-25630—A vulnerability was found in Moodle where the decompressed size of zip files was not checked against available user quota before unzipping tEPSS 1.4%CVE-2019-10942—A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT sEPSS 1.4%