Falhas do tipo CWE-400

3.450 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2020-26652—An issue was discovered in function nl80211_send_chandef in rtl8812au v5.6.4.2 allows attackers to cause a denial of service.EPSS 0.7%CVE-2026-1605HIGHIn Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with EPSS 0.7%CVE-2021-44319HIGHParrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service. The Parrot AR.Drone platform is vulnerable to Wi-Fi deauthentication aEPSS 0.7%CVE-2026-66142HIGHApache Neethi: Uncontrolled recursion in policy processingEPSS 0.7%CVE-2026-59173HIGHApache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditionsEPSS 0.7%CVE-2026-24012HIGHApache IoTDB: Denial of Service via Resource Exhaustion in Aggregation QueryEPSS 0.7%CVE-2026-66144HIGHApache Neethi: Remote PolicyReference fetch lacks resource boundsEPSS 0.7%CVE-2022-1468MEDIUMOn all versions of 17.0.x, 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x on F5 BIG-IP, an authenticated iControl REST user with at leasEPSS 0.7%CVE-2025-0187HIGHDenial of Service (DoS) by Sending Large Filename at File Upload Endpoint in gradio-app/gradioEPSS 0.7%CVE-2025-48795MEDIUMApache CXF: Denial of Service and sensitive data exposure in logsEPSS 0.7%CVE-2022-23487HIGHlibp2p denial of service vulnerability from lack of resource managementEPSS 0.7%CVE-2026-81755HIGHApache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC RequestEPSS 0.7%CVE-2022-23486HIGHlibp2p-rust denial of service vulnerability from lack of resource managementEPSS 0.7%CVE-2021-36395HIGHIn Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service.EPSS 0.7%CVE-2022-34335MEDIUMIBM Sterling Partner Engagement Manager denial of serviceEPSS 0.7%CVE-2026-57819HIGHApache CXF: No default restriction on the amount of form parameters per messageEPSS 0.7%CVE-2020-15853MEDIUMsupybot-fedora implements the command 'refresh', that refreshes the cache of all users from FAS. This takes quite a while to run, and zodbotEPSS 0.7%CVE-2025-8537MEDIUMAxiomatic Bento4 mp4decrypt Mp4Decrypt.cpp SetDataSize allocation of resourcesEPSS 0.7%CVE-2026-58182HIGHApache Traffic Server: ts_lua plugin has initialization and resource-handling errorsEPSS 0.7%CVE-2024-20351HIGHCisco Firepower Threat Defense Software Snort Firewall Denial of Service VulnerabilityEPSS 0.7%