Falhas do tipo CWE-400

3.450 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2022-28229HIGHThe hash functionality in userver before 42059b6319661583b3080cab9b595d4f8ac48128 allows attackers to cause a denial of service via crafted EPSS 0.8%CVE-2024-12063HIGHDenial of Service in imartinez/privategptEPSS 0.8%CVE-2026-3505HIGHUnbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.EPSS 0.8%CVE-2026-34665HIGHCAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)EPSS 0.8%CVE-2025-4533MEDIUMJeecgBoot Document Library Upload zip unzipFile resource consumptionEPSS 0.8%CVE-2023-29499MEDIUMGvariant offset table entry size is not checked in is_normal()EPSS 0.8%CVE-2023-50249HIGHSentry's Astro SDK vulnerable to ReDoSEPSS 0.8%CVE-2023-41707MEDIUMProcessing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing loadEPSS 0.8%CVE-2023-41705MEDIUMProcessing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load.EPSS 0.8%CVE-2023-41706MEDIUMProcessing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. AvEPSS 0.8%CVE-2022-42929MEDIUMIf a website called `window.print()` in a particular way, it could cause a denial of service of the browser, which may persist beyond browseEPSS 0.8%CVE-2026-49289HIGHSimpleSAMLphp SAML2: Possible DoS via XPath TransformEPSS 0.8%CVE-2022-35236HIGHHTTP2 profile vulnerability CVE-2022-35236EPSS 0.8%CVE-2022-33203HIGHBIG-IP APM and F5 SSL Orchestrator vulnerability CVE-2022-33203EPSS 0.8%CVE-2022-38871HIGHIn Free5gc v3.0.5, the AMF breaks due to malformed NAS messages.EPSS 0.8%CVE-2024-1569MEDIUMUncontrolled Resource Consumption in parisneo/lollms-webuiEPSS 0.8%CVE-2026-54399HIGHApache HttpComponents Core: Unbounded HTTP Header/Line Length in Default ConfigurationEPSS 0.8%CVE-2024-7771MEDIUMDenial of Service in mintplex-labs/anything-llmEPSS 0.8%CVE-2024-33664MEDIUMpython-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web EncrypEPSS 0.8%CVE-2024-3569HIGHDenial of Service (DoS) Vulnerability in mintplex-labs/anything-llmEPSS 0.8%