Falhas do tipo CWE-400

3.438 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2021-41546—A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCEPSS 1.0%CVE-2025-24247CRITICALA type confusion issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.EPSS 1.0%CVE-2023-25151HIGHDoS vulnerability for high cardinality metrics in opentelemetry-go-contribEPSS 1.0%CVE-2024-28854HIGHSlow loris vulnerability with default configuration in tls-listenerEPSS 1.0%CVE-2025-7070MEDIUMIROAD Dashcam Q9 MFA Pairing Request allocation of resourcesEPSS 1.0%CVE-2023-41102HIGHAn issue was discovered in the captive portal in OpenNDS before version 10.1.3. It has multiple memory leaks due to not freeing up allocatedEPSS 1.0%CVE-2022-22161HIGHJunos OS: MX104 might become unresponsive if the out-of-band management port receives a flood of trafficEPSS 1.0%CVE-2024-29893MEDIUMUncontrolled Resource Consumption vulnerability in ArgoCD's repo serverEPSS 1.0%CVE-2022-2529HIGHMultiple DoS Attack Vectors in sflow packet handlingEPSS 1.0%CVE-2023-20861—In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible fEPSS 1.0%CVE-2024-21057MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 aEPSS 1.0%CVE-2023-3398MEDIUMDenial of Service in jgraph/drawioEPSS 1.0%CVE-2022-3509HIGHParsing issue in protobuf textformatEPSS 1.0%CVE-2025-21575MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.0-8.0.4EPSS 1.0%CVE-2018-15437MEDIUMCisco Immunet and Cisco AMP for Endpoints System Scan Denial of Service VulnerabilityEPSS 1.0%CVE-2023-22484LOWInefficient Quadratic complexity bug in handle_pointy_brace may lead to a denial of serviceEPSS 1.0%CVE-2021-23049—On BIG-IP version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3, when the iRules RESOLVER::summarize command is used on a virtual server, EPSS 1.0%CVE-2021-0233HIGHJunos OS: ACX500 Series, ACX4000 Series: Denial of Service due to FFEB crash while processing high rate of specific packets.EPSS 1.0%CVE-2021-0230HIGHJunos OS: SRX Series: Memory leak when querying Aggregated Ethernet (AE) interface statisticsEPSS 1.0%CVE-2021-3478—There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta. An attacker able to submit a crafted file to beEPSS 1.0%