Falhas do tipo CWE-400

3.450 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2021-4021—A vulnerability was found in Radare2 in versions prior to 5.6.2, 5.6.0, 5.5.4 and 5.5.2. Mapping a huge section filled with zeros of an ELF6EPSS 1.1%CVE-2021-20234—An uncontrolled resource consumption (memory leak) flaw was found in the ZeroMQ client in versions before 4.3.3 in src/pipe.cpp. This issue EPSS 1.1%CVE-2020-1722MEDIUMA flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the pasEPSS 1.1%CVE-2021-23236HIGHFresenius Kabi Agilia Connect Infusion System uncontrolled resource consumptionEPSS 1.1%CVE-2023-28837MEDIUMWagtail vulnerable to denial-of-service via memory exhaustion when uploading large filesEPSS 1.1%CVE-2022-3277MEDIUMAn uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of seEPSS 1.1%CVE-2025-15532MEDIUMOpen5GS Timer resource consumptionEPSS 1.1%CVE-2025-59502HIGHRemote Procedure Call Denial of Service VulnerabilityEPSS 1.1%CVE-2020-1684HIGHJunos OS: SRX Series: High CPU load due to processing for HTTP traffic when Application Identification is enabled.EPSS 1.1%CVE-2024-20977MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 aEPSS 1.1%CVE-2019-3554—Wangle's AcceptRoutingHandler incorrectly casts a socket when accepting a TLS 1.3 connection, leading to a potential denial of service attacEPSS 1.1%CVE-2021-26260—An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could EPSS 1.1%CVE-2026-94449HIGHQuarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of serviceEPSS 1.1%CVE-2025-21529MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected areEPSS 1.1%CVE-2024-0348MEDIUMSourceCodester Engineers Online Portal File Upload resource consumptionEPSS 1.1%CVE-2022-23492HIGHgo-libp2p denial of service vulnerability from lack of resource managementEPSS 1.1%CVE-2023-48834HIGHA lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion.EPSS 1.1%CVE-2022-3147LOWServer-side Denial of Service while processing a specifically crafted JPEG fileEPSS 1.1%CVE-2023-22799—A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regulEPSS 1.0%CVE-2006-5708HIGHMultiple unspecified vulnerabilities in MDaemon and WorldClient in Alt-N Technologies MDaemon before 9.50 allow attackers to cause a denial EPSS 1.0%