Falhas do tipo CWE-400

3.450 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2022-22543—SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) - versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.EPSS 1.4%CVE-2019-19301HIGHA vulnerability has been identified in SCALANCE X200-4P IRT, SCALANCE X201-3P IRT, SCALANCE X201-3P IRT PRO, SCALANCE X202-2IRT, SCALANCE X2EPSS 1.4%CVE-2019-10942—A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT sEPSS 1.4%CVE-2025-24126CRITICALAn input validation issue was addressed. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS VenEPSS 1.4%CVE-2022-39271HIGHTraefik HTTP/2 connections management could cause a denial of serviceEPSS 1.4%CVE-2020-14384—A flaw was found in JBossWeb in versions before 7.5.31.Final-redhat-3. The fix for CVE-2020-13935 was incomplete in JBossWeb, leaving it vulEPSS 1.4%CVE-2021-1460MEDIUMCisco IOx Application Framework Denial of Service VulnerabilityEPSS 1.4%CVE-2022-21689HIGHDenial of Service in OnionshareEPSS 1.3%CVE-2020-11645MEDIUMGateManager Denial of Service VulnerabilityEPSS 1.3%CVE-2023-39321—Panic when processing post-handshake message on QUIC connections in crypto/tlsEPSS 1.3%CVE-2022-39280MEDIUMRegular expression denial of service in dparseEPSS 1.3%CVE-2023-46120MEDIUMRabbitMQ Java client's lack of message size limitation leads to remote DoS attackEPSS 1.3%CVE-2021-32722MEDIUMUncontrolled Resource Consumption in GlobalNewFilesEPSS 1.3%CVE-2021-39171MEDIUMUnlimited transforms allowed for signed nodesEPSS 1.3%CVE-2021-3629—A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead EPSS 1.3%CVE-2017-16021—uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or notEPSS 1.3%CVE-2019-0059HIGHJunos OS: The routing protocol process (rpd) may crash and generate core files upon receipt of specific valid BGP states from a peered host.EPSS 1.3%CVE-2023-34458HIGHmx-chain-go's relayed transactions always increment nonceEPSS 1.3%CVE-2020-3190MEDIUMCisco IOS XR Software IPsec Packet Processor Denial of Service VulnerabilityEPSS 1.3%CVE-2016-10544—uws is a WebSocket server library. By sending a 256mb websocket message to a uws server instance with permessage-deflate enabled, there is aEPSS 1.3%