Falhas do tipo CWE-400

3.450 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2023-24545HIGHOn affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malformed packets to the switch.EPSS 0.8%CVE-2026-25949HIGHTraefik: TCP readTimeout bypass via STARTTLS on PostgresEPSS 0.8%CVE-2024-57519HIGHAn issue in Open5GS v.2.7.2 allows a remote attacker to cause a denial of service via the ogs_dbi_auth_info function in lib/dbi/subscriptionEPSS 0.8%CVE-2022-3510HIGHParsing issue in protobuf message-type extensionEPSS 0.8%CVE-2022-34326HIGHIn ambiot amb1_sdk (aka SDK for Ameba1) before 2022-06-20 on Realtek RTL8195AM devices before 284241d70308ff2519e40afd7b284ba892c730a3, the EPSS 0.8%CVE-2024-4436HIGHEtcd: incomplete fix for cve-2022-41723 in openstack platformEPSS 0.8%CVE-2024-4437HIGHEtcd: incomplete fix for cve-2021-44716 in openstack platformEPSS 0.8%CVE-2024-45163CRITICALThe Mirai botnet through 2024-08-19 mishandles simultaneous TCP connections to the CNC (command and control) server. Unauthenticated sessionEPSS 0.8%CVE-2022-46399HIGHThe Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) is unresponsive with ConReqTimeoutZerEPSS 0.8%CVE-2026-69208HIGHHttp4s: DigestAuth nonce map grows unboundedEPSS 0.8%CVE-2022-33168HIGHIBM Security Directory Suite VA denial of serviceEPSS 0.8%CVE-2026-48834HIGHApache Answer: Denial of service via crafted Accept-Language header parsingEPSS 0.8%CVE-2023-6193MEDIUMUnbounded queuing of path validation messages in cloudflare-quicheEPSS 0.8%CVE-2026-42403HIGHApache Neethi: Circular Policy Reference Infinite LoopEPSS 0.8%CVE-2023-35909MEDIUMWordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Denial of Service AttackEPSS 0.8%CVE-2026-57576MEDIUMplone.app.dexterity and plone.app.contenttypes have a Denial of Service due to excessive title or description lengthEPSS 0.8%CVE-2024-39462CRITICALclk: bcm: dvp: Assign ->num before accessing ->hwsEPSS 0.8%CVE-2024-32984HIGHYamux Memory Exhaustion Vulnerability via Active::pending_frames property EPSS 0.8%CVE-2026-54135HIGHAirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP ServerEPSS 0.8%CVE-2024-21177MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 aEPSS 0.8%