Falhas do tipo CWE-400

3.450 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2023-26470MEDIUMIn XWiki Platform, saving a document with a large object number leads to persistent OOM errorsEPSS 0.9%CVE-2026-66143HIGHApache Neethi: Missing global alternative-output budget across policy computation pathsEPSS 0.9%CVE-2024-47850HIGHCUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet reEPSS 0.9%CVE-2026-47073HIGHUnbounded memory consumption in WebSocket client in hackneyEPSS 0.9%CVE-2023-27314HIGHDenial of Service Vulnerability in ONTAP 9EPSS 0.9%CVE-2024-38809MEDIUMApplications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Users of affected versions sEPSS 0.9%CVE-2024-23259MEDIUMThe issue was addressed with improved checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14EPSS 0.9%CVE-2021-3912MEDIUMOctoRPKI crashes when processing GZIP bomb returned via malicious repositoryEPSS 0.9%CVE-2024-21142MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected aEPSS 0.9%CVE-2024-20996MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.37 and prior anEPSS 0.9%CVE-2024-21194MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior, 8EPSS 0.9%CVE-2024-21127MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.37 and priEPSS 0.9%CVE-2022-24109MEDIUMAn issue was discovered in ONOS 2.5.1. To attack an intent installed by a normal user, a remote attacker can install a duplicate intent withEPSS 0.8%CVE-2018-0471—Cisco IOS XE Software Cisco Discovery Protocol Memory Leak VulnerabilityEPSS 0.8%CVE-2026-54772HIGHCoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshakeEPSS 0.8%CVE-2024-5013HIGHWhatsUp Gold InstallController Denial-of-Service VulnerabilityEPSS 0.8%CVE-2024-32972HIGHgo-ethereum denial of service via malicious p2p messageEPSS 0.8%CVE-2024-49129HIGHWindows Remote Desktop Gateway (RD Gateway) Denial of Service VulnerabilityEPSS 0.8%CVE-2020-3203HIGHCisco IOS XE Software Catalyst 9800 Series Wireless Controllers Denial of Service VulnerabilityEPSS 0.8%CVE-2023-43810HIGHopentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metricsEPSS 0.8%