Falhas do tipo CWE-400

3.450 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2026-101895HIGHAngular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPEEPSS 0.9%CVE-2023-51775MEDIUMThe jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count)EPSS 0.9%CVE-2020-1750—A flaw was found in the machine-config-operator that causes an OpenShift node to become unresponsive when a container consumes a large amounEPSS 0.9%CVE-2026-54428HIGHApache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACKEPSS 0.9%CVE-2022-4006LOWWBCE CMS Header class.login.php increase_attempts excessive authenticationEPSS 0.9%CVE-2023-45621HIGHUnauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of EPSS 0.9%CVE-2023-45622HIGHUnauthenticated Denial-of-Service (DoS) vulnerabilities exist in the BLE daemon service accessed via the PAPI protocol. Successful exploitatEPSS 0.9%CVE-2023-48713MEDIUMKnative Serving vulnerable to attacker-controlled pod causing denial of service of autoscalerEPSS 0.9%CVE-2023-20051MEDIUMCisco Packet Data Network Gateway IPsec ICMP Denial of Service VulnerabilityEPSS 0.9%CVE-2023-35920HIGHA vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (AlEPSS 0.9%CVE-2023-35921HIGHA vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (AlEPSS 0.9%CVE-2023-20176MEDIUMA vulnerability in the networking component of Cisco access point (AP) software could allow an unauthenticated, remote attacker to cause a tEPSS 0.9%CVE-2024-21185MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.38, 8.4.1 and EPSS 0.9%CVE-2024-35270MEDIUMWindows iSCSI Service Denial of Service VulnerabilityEPSS 0.9%CVE-2026-33176MEDIUMRails Active Support has a possible DoS vulnerability in its number helpersEPSS 0.9%CVE-2025-30704MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected arEPSS 0.9%CVE-2023-25568HIGHBoxo bitswap/server: DOS unbounded persistent memory leakEPSS 0.9%CVE-2022-24035HIGHAn issue was discovered in ONOS 2.5.1. The purge-requested intent remains on the list, but it does not respond to changes in topology (e.g.,EPSS 0.9%CVE-2018-0441HIGHCisco IOS Access Points Software 802.11r Fast Transition Denial of Service VulnerabilityEPSS 0.9%CVE-2022-24040—A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXEPSS 0.9%