Falhas do tipo CWE-400

3.450 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2023-23296MEDIUMKorenix JetWave 4200 Series 1.3.0 and JetWave 3200 Series 1.6.0 are vulnerable to Denial of Service via /goform/formDefault.EPSS 0.8%CVE-2023-27483MEDIUMfieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtimeEPSS 0.8%CVE-2026-1174MEDIUMbirkir prime GraphQL Alias graphql resource consumptionEPSS 0.8%CVE-2025-43193CRITICALThe issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7.EPSS 0.8%CVE-2022-23591HIGHStack overflow in TensorflowEPSS 0.8%CVE-2024-39895MEDIUMDirectus GraphQL Field Duplication Denial of Service (DoS)EPSS 0.8%CVE-2025-1948HIGHEclipse Jetty HTTP clients can increase memory allocationEPSS 0.8%CVE-2021-38463HIGHAUVESY VersiondogEPSS 0.8%CVE-2026-73507HIGHNetty: Denial of Service in XmlFrameDecoder via CPU ExhaustionEPSS 0.8%CVE-2024-9358MEDIUMThingsBoard HTTP RPC API resource consumptionEPSS 0.8%CVE-2026-40984HIGHMicrometer HTTP server instrumentations DoS vulnerabilityEPSS 0.8%CVE-2023-48951HIGHAn issue in the box_equal function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after runningEPSS 0.8%CVE-2024-4438HIGHEtcd: incomplete fix for cve-2023-39325/cve-2023-44487 in openstack platformEPSS 0.8%CVE-2023-6596HIGHOpenshift: incomplete fix for rapid reset (cve-2023-44487/cve-2023-39325)EPSS 0.8%CVE-2021-41168MEDIUMHash-Collision Denial-of-Service Vulnerability in snudownEPSS 0.8%CVE-2024-22362HIGHDrupal contains a vulnerability with improper handling of structural elements. If this vulnerability is exploited, an attacker may be able tEPSS 0.8%CVE-2023-32636MEDIUMA flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validaEPSS 0.8%CVE-2016-10524—i18n-node-angular is a module used to interact between i18n and angular without using additional resources. A REST API endpoint that is usedEPSS 0.8%CVE-2026-12151HIGHundici WebSocket client vulnerable to denial of service via fragment count bypassEPSS 0.8%CVE-2025-4215LOWgorhill uBlock Origin UI 1p-filters.js currentStateChanged redosEPSS 0.8%