Falhas do tipo CWE-400

3.000 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2024-4599HIGHDenial of service vulnerability in LAN MessengerEPSS 0.7%CVE-2023-38251MEDIUMAdobe Commerce | Uncontrolled Resource Consumption (CWE-400)EPSS 0.7%CVE-2026-58483HIGHmcp-searxng: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`EPSS 0.7%CVE-2026-86040HIGHlibp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoSEPSS 0.7%CVE-2022-41833HIGHBIG-IP iRule vulnerability CVE-2022-41833EPSS 0.7%CVE-2022-41806HIGHBIG-IP AFM NAT64 Policy Vulnerability CVE-2022-41806EPSS 0.7%CVE-2024-29186MEDIUMSlow String Operations via MultiPart Requests in Event-Driven FunctionsEPSS 0.7%CVE-2023-43775MEDIUMSecurity issue in SMP Gateway automation platformEPSS 0.7%CVE-2026-1605HIGHIn Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with EPSS 0.7%CVE-2026-55833HIGHNetty SPDY zlib header block continues decoded expansion after maxHeaderSize truncationEPSS 0.7%CVE-2026-56819HIGHNetty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)EPSS 0.7%CVE-2026-55831HIGHNetty SPDY SETTINGS frame count materializes unbounded settings mapEPSS 0.7%CVE-2019-0046MEDIUMJunos OS: EX4300 Series: Denial of Service upon receipt of large number of specific valid packets on management interface.EPSS 0.7%CVE-2024-5422HIGHDenial of ServiceEPSS 0.7%CVE-2026-34148HIGHFedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolutionEPSS 0.7%CVE-2026-59879HIGHImmutable.js `List` 32-bit trie overflow → unrecoverable DoSEPSS 0.7%CVE-2024-25718CRITICALIn the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access EPSS 0.7%CVE-2026-65324HIGHApache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustionEPSS 0.7%CVE-2026-58151HIGHApache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the serverEPSS 0.7%CVE-2026-64958HIGHApache CXF: Denial of service via message header attachmentsEPSS 0.7%