Falhas do tipo CWE-400

3.000 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2022-31080MEDIUMKubeEdge Websocket Client in package Viaduct: DoS from large response messageEPSS 0.7%CVE-2026-90582MEDIUMevanchiu serverless-todo API Todo Endpoint index.js saveTodos resource consumptionEPSS 0.7%CVE-2026-86513MEDIUMjava-json-tools jackson-coreutils JSON Pointer parser TreePointer.java TreePointer.tokensFromInput allocation of resourcesEPSS 0.7%CVE-2026-93310MEDIUMO-RAN-SC SMO OAM VES Collector allocation of resourcesEPSS 0.7%CVE-2026-92220MEDIUMvllm-project vLLM MoRIIO Acknowledgement moriio_connector.py MoRIIOWrapper._handle_release_message resource consumptionEPSS 0.7%CVE-2026-86511MEDIUMjava-json-tools jackson-coreutils JacksonUtils.java BigDecimal.toPlainString resource consumptionEPSS 0.7%CVE-2026-21720HIGHUnauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time outEPSS 0.7%CVE-2026-86319MEDIUMjava-json-tools json-patch Patch Operation JsonPatch.java JsonPatch.apply resource consumptionEPSS 0.7%CVE-2023-41151HIGHAn uncaught exception issue discovered in Softing OPC UA C++ SDK before 6.30 for Windows operating system may cause the application to crashEPSS 0.7%CVE-2026-45768HIGHSuricata ldap: unbounded responses per transaction can lead to resource exhaustionEPSS 0.7%CVE-2026-26999HIGHTraefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS)EPSS 0.7%CVE-2026-57227HIGHSuricata mqtt: unbounded resource consumption from repeated pubrec and pubrel messagesEPSS 0.7%CVE-2026-47077HIGHUnbounded body accumulation in HTTP/3 response loop in hackneyEPSS 0.7%CVE-2024-24750MEDIUMBackpressure request ignored in fetch() in UndiciEPSS 0.7%CVE-2026-59932HIGHPhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustionEPSS 0.7%CVE-2023-39248HIGH Dell OS10 Networking Switches running 10.5.2.x and above contain an Uncontrolled Resource Consumption (Denial of Service) vulnerability, whEPSS 0.7%CVE-2026-59933HIGHPhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustionEPSS 0.7%CVE-2026-47071HIGHSOCKS5 TLS upgrade ignores caller timeout in hackneyEPSS 0.7%CVE-2024-57655HIGHAn issue in the dfe_n_in_order component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via craEPSS 0.7%CVE-2023-50707CRITICALUncontrolled Resource Consumption in EFACEC BCU 500EPSS 0.7%