Falhas do tipo CWE-400

3.450 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2026-61814HIGHJawn: Quadratic parsing effort in AsyncParserEPSS 0.8%CVE-2026-55108HIGHKubeVela Terraform remote loader DoS via unbounded file readEPSS 0.8%CVE-2024-24752MEDIUMBref Uploaded Files Not Deleted in Event-Driven FunctionsEPSS 0.8%CVE-2023-51293HIGHA lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Event Booking Calendar v4.0 allows attackers to senEPSS 0.7%CVE-2023-51314HIGHA lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Restaurant Booking System v3.0 allows attackers to EPSS 0.7%CVE-2023-51316HIGHA lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Bus Reservation System v1.1 allows attackers to send an excessive amoEPSS 0.7%CVE-2023-51301HIGHA lack of rate limiting in the "Login Section, Forgot Email" feature of PHPJabbers Hotel Booking System v4.0 allows attackers to send an excEPSS 0.7%CVE-2024-21163MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 aEPSS 0.7%CVE-2022-41833HIGHBIG-IP iRule vulnerability CVE-2022-41833EPSS 0.7%CVE-2022-41806HIGHBIG-IP AFM NAT64 Policy Vulnerability CVE-2022-41806EPSS 0.7%CVE-2024-25398HIGHIn Srelay (the SOCKS proxy and Relay) v.0.4.8p3, a specially crafted network payload can trigger a denial of service condition and disrupt tEPSS 0.7%CVE-2022-45044MEDIUMA vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.50), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 EPSS 0.7%CVE-2026-68763HIGHApache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is resetEPSS 0.7%CVE-2026-45860HIGHnetfilter: nf_conncount: increase the connection clean up limit to 64EPSS 0.7%CVE-2026-39865MEDIUMAxios HTTP/2 Session Cleanup State Corruption VulnerabilityEPSS 0.7%CVE-2024-11033MEDIUMDenial of Service (DoS) in binary-husky/gpt_academicEPSS 0.7%CVE-2026-58210HIGHNATS Server: MQTT partial CONNECT packets can exhaust pre-auth memoryEPSS 0.7%CVE-2025-47270HIGHnimiq-network-libp2p Uncontrolled Resource Consumption vulnerabilityEPSS 0.7%CVE-2019-0038MEDIUMSRX Series: Crafted packets destined to fxp0 management interface on SRX340/SRX345 devices can lead to DoSEPSS 0.7%CVE-2025-49763HIGHApache Traffic Server: Remote DoS via memory exhaustion in ESI PluginEPSS 0.7%