Falhas do tipo CWE-400

3.450 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2024-10466HIGHBy sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive.EPSS 0.8%CVE-2020-1625MEDIUMJunos OS: Kernel memory leak in virtual-memory due to interface flapsEPSS 0.8%CVE-2026-78058HIGHApache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive PathEPSS 0.8%CVE-2023-20259HIGHA vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, remote attacker to causEPSS 0.8%CVE-2026-100650HIGHvLLM before 0.29.0 Resource Exhaustion via Unbounded Media MaterializationEPSS 0.8%CVE-2024-8418HIGHContainers/aardvark-dns: tcp query handling flaw in aardvark-dns leading to denial of serviceEPSS 0.8%CVE-2026-79651HIGHKeycloak-services: keycloak-services: unauthenticated dos via unbounded locale cachingEPSS 0.8%CVE-2026-4926HIGHpath-to-regexp vulnerable to Denial of Service via sequential optional groupsEPSS 0.8%CVE-2025-70327CRITICALTOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of the /usr/sbin/lighttpEPSS 0.8%CVE-2025-24269CRITICALThe issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An app may be able to cause unexpected sysEPSS 0.8%CVE-2022-22145—CAMS for HIS Log Server contained in the following Yokogawa Electric products is vulnerable to uncontrolled resource consumption. CENTUM CS EPSS 0.8%CVE-2023-49800HIGHDenial of service by abusing `fetchOptions.retry` in nuxt-api-partyEPSS 0.8%CVE-2022-3818MEDIUMAn uncontrolled resource consumption issue when parsing URLs in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, aEPSS 0.8%CVE-2026-27858HIGHAttacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. AttackeEPSS 0.8%CVE-2021-0215MEDIUMJunos OS: EX Series, QFX Series, SRX Branch Series, MX Series: Memory leak in packet forwarding engine due to 802.1X authenticator port interface flapsEPSS 0.8%CVE-2026-75507HIGHGraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation ruleEPSS 0.8%CVE-2022-35915MEDIUMUnbounded gas consumption in @openzeppelin/contractsEPSS 0.8%CVE-2023-23296MEDIUMKorenix JetWave 4200 Series 1.3.0 and JetWave 3200 Series 1.6.0 are vulnerable to Denial of Service via /goform/formDefault.EPSS 0.8%CVE-2024-43380MEDIUMfugit parse and parse_nat stall on lengthy inputEPSS 0.8%CVE-2023-0384MEDIUMUncontrolled Resource Consuption in M-Files ServerEPSS 0.8%