Falhas do tipo CWE-400

3.450 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2022-23030—On version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when the BIG-IP Virtual EditionEPSS 0.9%CVE-2024-21203MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 8.0.39 and priEPSS 0.9%CVE-2024-21207MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.38 and prior, 8EPSS 0.9%CVE-2023-50966MEDIUMerlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c (EPSS 0.9%CVE-2024-21055MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 aEPSS 0.9%CVE-2026-48050HIGHArc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoSEPSS 0.9%CVE-2022-4952LOWOmniSharp csharp-language-server-protocol JSON Serializer SerializerBase.cs CreateSerializerSettings resource consumptionEPSS 0.9%CVE-2023-6681MEDIUMJwcrypto: denail of service via specifically crafted jweEPSS 0.9%CVE-2026-67626MEDIUMMicrosoft SQL Server Denial of Service VulnerabilityEPSS 0.9%CVE-2022-2406MEDIUMMalicious imports can lead to Denial of ServiceEPSS 0.9%CVE-2023-46361—Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.EPSS 0.9%CVE-2023-21838HIGHVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected areEPSS 0.9%CVE-2026-96541HIGHGnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadlineEPSS 0.9%CVE-2024-12864HIGHUnauthenticated DoS by Sending Large Filename at File Upload Endpoint in netease-youdao/qanythingEPSS 0.9%CVE-2024-12070HIGHDenial of Service in haotian-liu/llavaEPSS 0.9%CVE-2021-22642HIGHOvarro TBox Uncontrolled Resource ConsumptionEPSS 0.9%CVE-2024-21171MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 aEPSS 0.9%CVE-2024-21196MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: X Plugin). Supported versions that are affected are 8.0.39 anEPSS 0.9%CVE-2024-20716MEDIUMForce high-usage of resources by generating unlimited coupons: Adobe CommerceEPSS 0.9%CVE-2024-21231LOWVulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 8.0.39 andEPSS 0.9%