Falhas do tipo CWE-400

3.409 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2022-31075MEDIUMKubeEdge DoS when signing the CSR from EdgeCoreEPSS 1.0%CVE-2022-43572HIGHIndexing blockage via malformed data sent through S2S or HEC protocols in Splunk EnterpriseEPSS 1.0%CVE-2024-3789MEDIUMUncontrolled Resource Consumption vulnerability in WBSAirbackEPSS 1.0%CVE-2022-43740HIGHIBM Security Verify Access denial of serviceEPSS 1.0%CVE-2023-3153MEDIUMService monitor mac flow is not rate limitedEPSS 1.0%CVE-2024-21051MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.34 and priEPSS 1.0%CVE-2026-21945HIGHVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: SecuritEPSS 1.0%CVE-2023-1605HIGHDenial of Service in radareorg/radare2EPSS 1.0%CVE-2026-42587HIGHNetty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoSEPSS 1.0%CVE-2024-1309MEDIUMResource Consumption Identified in NTP before 4.2.4p8 and 4.2.5EPSS 1.0%CVE-2026-111752HIGHAngular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)EPSS 1.0%CVE-2021-31340—A vulnerability has been identified in SIMATIC RF166C (All versions > V1.1 and < V1.3.2), SIMATIC RF185C (All versions > V1.1 and < V1.3.2),EPSS 1.0%CVE-2024-21050MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.34 and priEPSS 1.0%CVE-2022-27889MEDIUMThe Foundry Multipass service contains code paths that could be abused to cause a denial of service for authentication and authorization operations.EPSS 1.0%CVE-2025-30715MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected arEPSS 1.0%CVE-2025-30705MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.0.0-8.0.41, 8EPSS 1.0%CVE-2023-49140HIGHDenial-of-service (DoS) vulnerability exists in commplex-link service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specEPSS 1.0%CVE-2022-38100HIGHContec Health CMS8000EPSS 1.0%CVE-2023-5625MEDIUMPython-eventlet: patch regression for cve-2021-21419 in some red hat buildsEPSS 1.0%CVE-2021-41546—A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCEPSS 1.0%