Falhas do tipo CWE-400

3.450 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2024-41818HIGHReDOS at currency parsing fast-xml-parserEPSS 0.8%CVE-2022-23580MEDIUMAbort caused by allocating a vector that is too large in TensorflowEPSS 0.8%CVE-2023-4486HIGHUncontrolled Resource Consumption in Metasys and Facility ExplorerEPSS 0.8%CVE-2023-50730HIGHGrackle has StackOverflowError in GraphQL query processingEPSS 0.8%CVE-2024-20344MEDIUMA vulnerability in system resource management in Cisco UCS 6400 and 6500 Series Fabric Interconnects that are in Intersight Managed Mode (IMEPSS 0.8%CVE-2025-5024HIGHGnome-remote-desktop: uncontrolled resource consumption due to malformed rdp pdusEPSS 0.8%CVE-2026-92596HIGHNodemailer before 9.1.0 Denial of Service via addressparserEPSS 0.8%CVE-2022-31074MEDIUMKubeEdge Cloud AdmissionController component DoSEPSS 0.8%CVE-2022-21653MEDIUMHash collision in typelevel jawnEPSS 0.8%CVE-2023-43775MEDIUMSecurity issue in SMP Gateway automation platformEPSS 0.8%CVE-2024-21130MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 aEPSS 0.8%CVE-2024-21173MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.37 and prior anEPSS 0.8%CVE-2024-9409HIGHCWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to become unresponsive resulting in communicaEPSS 0.8%CVE-2023-41173—AdGuard DNS before 2.2 allows remote attackers to cause a denial of service via malformed UDP packets.EPSS 0.8%CVE-2022-39294HIGH(DoS) Denial of Service from unchecked request length in conduit-hyperEPSS 0.8%CVE-2026-42154HIGHPrometheus: remote read endpoint allows denial of service via crafted snappy payloadEPSS 0.8%CVE-2023-37022HIGHOpen5GS MME versions <= 2.6.4 contain a reachable assertion in the `UE Context Release Request` packet handler. A packet containing an invalEPSS 0.8%CVE-2023-37014HIGHOpen5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An EPSS 0.8%CVE-2025-30681LOWVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.0-EPSS 0.8%CVE-2020-1625MEDIUMJunos OS: Kernel memory leak in virtual-memory due to interface flapsEPSS 0.8%