Falhas do tipo CWE-400

3.393 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2023-30999HIGHIBM Security Access Manager denial of serviceEPSS 1.0%CVE-2022-20808HIGHCisco Smart Software Manager On-Prem Denial of Service VulnerabilityEPSS 1.0%CVE-2024-20964MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected aEPSS 1.0%CVE-2021-22964—A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox useEPSS 1.0%CVE-2022-27508HIGHUnauthenticated denial of service EPSS 1.0%CVE-2023-42457HIGHplone.rest vulnerable to Denial of Service when ++api++ is used many timesEPSS 1.0%CVE-2021-32816MEDIUMRegular expression Denial of Service in ProtonMailEPSS 1.0%CVE-2022-3613MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versioEPSS 1.0%CVE-2024-38027MEDIUMWindows Line Printer Daemon Service Denial of Service VulnerabilityEPSS 1.0%CVE-2026-42579HIGHNetty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)EPSS 1.0%CVE-2022-0476HIGHDenial of Service in radareorg/radare2EPSS 1.0%CVE-2014-3648—The simplepush server iterates through the application installations and pushes a notification to the server provided by deviceToken. But thEPSS 1.0%CVE-2024-32476MEDIUMDenial of Service via malicious jqPathExpressions in ignoreDifferencesEPSS 1.0%CVE-2024-10599MEDIUMTongda OA 2017 package_static_resources.php resource consumptionEPSS 1.0%CVE-2021-22101—Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability allowing unauthenticated aEPSS 1.0%CVE-2021-28510MEDIUMFor certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid Type-Length-Value (TLV) causes the PTP agent to restart. Repeated restarts of the service will make the service unavailable.EPSS 1.0%CVE-2021-29453MEDIUMDenial of service through memory exhaustionEPSS 1.0%CVE-2023-44321MEDIUMAffected devices do not properly validate the length of inputs when performing certain configuration changes in the web interface allowing aEPSS 1.0%CVE-2021-22139—Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limitEPSS 1.0%CVE-2022-31075MEDIUMKubeEdge DoS when signing the CSR from EdgeCoreEPSS 1.0%