Falhas do tipo CWE-400

3.450 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2023-3782MEDIUMDoS of the OkHttp client when using a BrotliInterceptor and surfing to a malicious web server, or when an attacker can perform MitM to inject a Brotli zip-bomb into an HTTP responseEPSS 0.7%CVE-2022-41770MEDIUMBIG-IP and BIG-IQ iControl REST vulnerability CVE-2022-41770EPSS 0.7%CVE-2024-12761HIGHDenial of Service in brycedrennan/imaginairyEPSS 0.7%CVE-2024-11043HIGHDenial of Service (DoS) via Large Payload in Board Name Field in invoke-ai/invokeaiEPSS 0.7%CVE-2023-28356HIGHA vulnerability has been identified where a maliciously crafted message containing a specific chain of characters can cause the chat to enteEPSS 0.7%CVE-2024-24781HIGHHima: Uncontrolled Resource Consumption in multiple productsEPSS 0.7%CVE-2023-45955—An issue discovered in Nanoleaf Light strip v3.5.10 allows attackers to cause a denial of service via crafted write binding attribute commanEPSS 0.7%CVE-2025-21614HIGHgo-git clients vulnerable to DoS via maliciously crafted Git server repliesEPSS 0.7%CVE-2024-31992MEDIUMMealie contains a DoS vulnerability in recipe importerEPSS 0.7%CVE-2023-39219HIGHAdmin Console Denial of Service via Java class enumerationEPSS 0.7%CVE-2024-23265CRITICALA memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPaEPSS 0.7%CVE-2024-1014MEDIUMUncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3EPSS 0.7%CVE-2026-20652HIGHThe issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOSEPSS 0.7%CVE-2026-45859HIGHnetfilter: nfnetlink_queue: do shared-unconfirmed check before segmentationEPSS 0.7%CVE-2026-42402HIGHApache Neethi: Policy Normalization Unbounded Resource Allocation DoSEPSS 0.7%CVE-2023-23616LOWDiscourse membership requests lack character limitEPSS 0.7%CVE-2026-117503MEDIUMa2aproject a2a-go REST SSE handler rest.go resource consumptionEPSS 0.7%CVE-2022-46352HIGHA vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALAEPSS 0.7%CVE-2024-20321HIGHA vulnerability in the External Border Gateway Protocol (eBGP) implementation of Cisco NX-OS Software could allow an unauthenticated, remoteEPSS 0.7%CVE-2026-55685HIGHReact Router: Unauthenticated Denial of Service via Inefficient Route MatchingEPSS 0.7%