Falhas do tipo CWE-400

3.450 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2023-26104HIGHAll versions of the package lite-web-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes coEPSS 1.2%CVE-2023-5915—A vulnerability of Uncontrolled Resource Consumption has been identified in STARDOM provided by Yokogawa Electric Corporation. This vulnerabEPSS 1.2%CVE-2022-31803MEDIUMCODESYS Gateway Server V2 prone to Denial of Service AttackEPSS 1.2%CVE-2021-41118MEDIUMReDoS in DynamicPageList3EPSS 1.2%CVE-2022-43238MEDIUMLibde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_h_3_v_3_sse in sse-motion.cc. This vulnerability allowsEPSS 1.2%CVE-2020-8192—A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (wheEPSS 1.2%CVE-2023-29449MEDIUMLimited control of resource utilization in JS preprocessingEPSS 1.2%CVE-2021-0229MEDIUMJunos OS: Receipt of specific packets could lead to Denial of Service in MQTT ServerEPSS 1.2%CVE-2022-31006HIGHHyperledger Indy DOS vulnerabilityEPSS 1.2%CVE-2022-29177MEDIUMDoS via malicious p2p message in Go-EthereumEPSS 1.2%CVE-2021-1266MEDIUMCisco Managed Services Accelerator Denial of Service VulnerabilityEPSS 1.2%CVE-2023-34324MEDIUMPossible deadlock in Linux kernel event handlingEPSS 1.2%CVE-2022-21700MEDIUMMemory leak in micronaut-coreEPSS 1.1%CVE-2017-2680HIGHSpecially crafted PROFINET DCP broadcast packets could cause a denial of service condition of affected products on a local Ethernet segment EPSS 1.1%CVE-2022-20692HIGHCisco IOS XE Software NETCONF Over SSH Denial of Service VulnerabilityEPSS 1.1%CVE-2023-26434MEDIUMWhen adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access tEPSS 1.1%CVE-2023-26433MEDIUMWhen adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. Attacker with access tEPSS 1.1%CVE-2023-26432MEDIUMWhen adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access tEPSS 1.1%CVE-2020-5423HIGHCloud Controller is vulnerable to denial of service via YAML parsingEPSS 1.1%CVE-2020-8123—A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbEPSS 1.1%