Falhas do tipo CWE-400

3.450 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2023-45319HIGHUnauthenticated Remote Denial-of-Service (Commit) in Helix Core EPSS 0.9%CVE-2021-33609MEDIUMDenial of service in DataCommunicator class in Vaadin 8EPSS 0.9%CVE-2022-36034HIGHPossible Regular Expression Denial of Service (ReDoS) used on uncontrolled data in nitrado.jsEPSS 0.9%CVE-2024-25978HIGHMsa-24-0001: denial of service risk in file picker unzip functionalityEPSS 0.9%CVE-2022-1982MEDIUMA crafted SVG attachment can crash a Mattermost serverEPSS 0.9%CVE-2024-6762LOWJetty PushSessionCacheFilter can cause remote DoS attacksEPSS 0.9%CVE-2024-21219MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.39 and priEPSS 0.9%CVE-2024-21218MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior, 8EPSS 0.9%CVE-2022-39374MEDIUMSynapse Denial of service due to incorrect application of event authorization rules during state resolutionEPSS 0.9%CVE-2023-52340HIGHThe IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max_size threshold that can be consumed easily, e.g., leading EPSS 0.9%CVE-2024-9823MEDIUMJetty DOS vulnerability on DosFilterEPSS 0.9%CVE-2022-43564MEDIUMDenial of Service in Splunk Enterprise through search macrosEPSS 0.9%CVE-2023-26141HIGHVersions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.jsEPSS 0.9%CVE-2022-41952MEDIUMUncontrolled Resource Consumption in Matrix Synapse EPSS 0.9%CVE-2022-43780HIGHCertain HP ENVY, OfficeJet, and DeskJet printers may be vulnerable to a Denial of Service attack.EPSS 0.9%CVE-2021-23042—On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, and 12.1.x before 12.1.6, when aEPSS 0.9%CVE-2020-3372MEDIUMCisco SD-WAN vManage Software Denial of Service VulnerabilityEPSS 0.9%CVE-2024-21230MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 aEPSS 0.9%CVE-2024-57708MEDIUMAn issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.EPSS 0.9%CVE-2022-28701HIGHOn F5 BIG-IP 16.1.x versions prior to 16.1.2.2, when the stream profile is configured on a virtual server, undisclosed requests can cause anEPSS 0.9%