Falhas do tipo CWE-400

2.995 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2024-25978HIGHMsa-24-0001: denial of service risk in file picker unzip functionalityEPSS 0.9%CVE-2024-6762LOWJetty PushSessionCacheFilter can cause remote DoS attacksEPSS 0.9%CVE-2022-39374MEDIUMSynapse Denial of service due to incorrect application of event authorization rules during state resolutionEPSS 0.9%CVE-2025-24247CRITICALA type confusion issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.EPSS 0.9%CVE-2023-52340HIGHThe IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max_size threshold that can be consumed easily, e.g., leading EPSS 0.9%CVE-2024-9823MEDIUMJetty DOS vulnerability on DosFilterEPSS 0.9%CVE-2023-26141HIGHVersions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.jsEPSS 0.9%CVE-2024-21230MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 aEPSS 0.9%CVE-2021-3821CRITICALA potential security vulnerability has been identified for certain HP multifunction printers (MFPs). The vulnerability may lead to Denial ofEPSS 0.9%CVE-2021-23042—On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, and 12.1.x before 12.1.6, when aEPSS 0.9%CVE-2020-3372MEDIUMCisco SD-WAN vManage Software Denial of Service VulnerabilityEPSS 0.9%CVE-2022-2794HIGHCertain HP PageWide Pro Printers may be vulnerable to a potential denial of service attack.EPSS 0.9%CVE-2025-61772HIGHRack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)EPSS 0.9%CVE-2025-61770HIGHRack's unbounded multipart preamble buffering enables DoS (memory exhaustion)EPSS 0.9%CVE-2022-22724—A CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service on ports 80 (HTTP) and 502 (Modbus), EPSS 0.9%CVE-2024-28863MEDIUMnode-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validationEPSS 0.9%CVE-2025-30705MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.0.0-8.0.41, 8EPSS 0.9%CVE-2025-30715MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected arEPSS 0.9%CVE-2024-21204MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.4.0 and 9.0.EPSS 0.9%CVE-2024-23835HIGHSuricata's pgsql: memory exhaustion use on record parsingEPSS 0.9%