Falhas do tipo CWE-400

3.000 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2026-45664MEDIUMImageMagick: Policy Bypass in MNG coder couldEPSS 0.6%CVE-2026-88975HIGHHttp4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZEEPSS 0.6%CVE-2026-63452HIGHSuricata http1: repeated brotli compression bombs can cause excessive CPU consumptionEPSS 0.6%CVE-2026-47736HIGHPuma PROXY Protocol v1 Parser Allows Remote Memory ExhaustionEPSS 0.6%CVE-2026-69213HIGHHttp4s Ember HTTP/2: unbounded outbound frame queueEPSS 0.6%CVE-2026-26307HIGHGitea git grep search lacks a timeoutEPSS 0.6%CVE-2026-81876HIGHHAPI FHIR: SHCParser DEFLATE infinite loop causes denial of serviceEPSS 0.6%CVE-2022-2741HIGHcan: denial-of-service can be triggered by a crafted CAN frameEPSS 0.6%CVE-2026-45756HIGHSymfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoSEPSS 0.6%CVE-2026-49851HIGHMistune: Potential DoS via quadratic-time parsing in parse_link_textEPSS 0.6%CVE-2025-65637HIGHA denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64EPSS 0.6%CVE-2026-81875HIGHHAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of serviceEPSS 0.6%CVE-2026-56745HIGHNetty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory ExhaustionEPSS 0.6%CVE-2026-38637HIGHAn issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a cEPSS 0.6%CVE-2026-55851HIGHNetty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory ExhaustionEPSS 0.6%CVE-2026-85721HIGHAsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of serviceEPSS 0.6%CVE-2026-69222HIGHLiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the processEPSS 0.6%CVE-2026-69202HIGHHttp4s Ember HTTP/2: unbounded inbound body bufferingEPSS 0.6%CVE-2026-9563HIGHIn Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number oEPSS 0.6%CVE-2026-55099HIGHicalendar: Algorithmic Complexity in EqualityEPSS 0.6%