Falhas do tipo CWE-400

3.450 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2017-16030—Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headeEPSS 1.1%CVE-2022-41861MEDIUMA flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server tEPSS 1.1%CVE-2026-49799MEDIUMWindows Local Security Authority Subsystem Service (LSASS) Denial of Service VulnerabilityEPSS 1.1%CVE-2025-5342MEDIUMDenial of Service (DoS)EPSS 1.1%CVE-2025-21574MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.0-8.0.4EPSS 1.1%CVE-2015-9239—ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.EPSS 1.1%CVE-2016-10520—jadedown is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.EPSS 1.1%CVE-2022-3639MEDIUMA potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 10.8 before 15.1.6, all versions starting from 15.2EPSS 1.1%CVE-2022-33142HIGHWordPress Better Messages plugin <= 1.9.10.57 - Denial Of Service (DoS) vulnerabilityEPSS 1.1%CVE-2024-27812HIGHA logic issue was addressed with improved file handling. This issue is fixed in visionOS 1.2. Processing web content may lead to a denial-ofEPSS 1.1%CVE-2022-48748HIGHnet: bridge: vlan: fix memory leak in __allowed_ingressEPSS 1.1%CVE-2020-15114HIGHDenial of Service in etcdEPSS 1.1%CVE-2021-31405HIGHRegular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17EPSS 1.1%CVE-2023-34104HIGHRegex Injection via Doctype EntitiesEPSS 1.1%CVE-2023-40180HIGHDenial of service vulnerability in silverstripe-graphql via recursive queriesEPSS 1.1%CVE-2023-20863MEDIUMIn spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL exEPSS 1.1%CVE-2023-40591HIGHDenial of service via malicious p2p message in go-ethereumEPSS 1.1%CVE-2022-21155HIGHFernhill SCADA Uncontrolled Resource ConsumptionEPSS 1.1%CVE-2023-28626MEDIUMQuadratic runtime when parsing Markdown in comrakEPSS 1.1%CVE-2026-21637MEDIUMA flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallbaEPSS 1.1%