Falhas do tipo CWE-400

3.450 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2021-0230HIGHJunos OS: SRX Series: Memory leak when querying Aggregated Ethernet (AE) interface statisticsEPSS 1.0%CVE-2021-3478—There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta. An attacker able to submit a crafted file to beEPSS 1.0%CVE-2021-3479—There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to beEPSS 1.0%CVE-2025-53012MEDIUMMaterialX's Lack of Import Depth Limit Leads to DoS (Denial-Of-Service) Via Stack ExhaustionEPSS 1.0%CVE-2024-0842HIGHBackuply - Backup, Restore, Migrate and Clone <= 1.2.6 - Denial of ServiceEPSS 1.0%CVE-2022-0695MEDIUMDenial of Service in radareorg/radare2EPSS 1.0%CVE-2022-28204HIGHA denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2. Rendering of w/index.php?title=Special%3AWhatLinksHere&target=PrEPSS 1.0%CVE-2024-32663HIGHSuricata 's http2 parser contains an improper compressed header handling can lead to resource starvationEPSS 1.0%CVE-2022-42950MEDIUMAn issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator accouEPSS 1.0%CVE-2021-3821CRITICALA potential security vulnerability has been identified for certain HP multifunction printers (MFPs). The vulnerability may lead to Denial ofEPSS 1.0%CVE-2023-30635HIGHTiKV 6.1.2 allows remote attackers to cause a denial of service (fatal error) upon an attempt to get a timestamp from the Placement Driver.EPSS 1.0%CVE-2023-37475HIGHAttacker-controlled parameter can cause denial of service in hamba avroEPSS 1.0%CVE-2023-20125HIGHCisco BroadWorks Network Server TCP Denial of Service VulnerabilityEPSS 1.0%CVE-2023-40583HIGHlibp2p nodes vulnerable to OOM attackEPSS 1.0%CVE-2022-41968LOWNextcloud Server's calendar name length not validated before writing to databaseEPSS 1.0%CVE-2022-2794HIGHCertain HP PageWide Pro Printers may be vulnerable to a potential denial of service attack.EPSS 0.9%CVE-2022-32927HIGHThe issue was addressed with improved memory handling. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 and iPadOS 16. Joining EPSS 0.9%CVE-2023-5759HIGHUnauthenticated Remote Denial-of-Service via Buffer in Helix CoreEPSS 0.9%CVE-2023-35767HIGHUnauthenticated Remote Denial-of-Service via Shutdown Function in Helix CoreEPSS 0.9%CVE-2023-45319HIGHUnauthenticated Remote Denial-of-Service (Commit) in Helix Core EPSS 0.9%