Falhas do tipo CWE-400

3.000 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2026-82397HIGHTornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loopEPSS 0.6%CVE-2026-38638HIGHAn issue in the with_argv function (/unistd/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafteEPSS 0.6%CVE-2026-63128HIGHRMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-serviceEPSS 0.6%CVE-2026-81875HIGHHAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of serviceEPSS 0.6%CVE-2026-69203HIGHHttp4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMSEPSS 0.6%CVE-2026-69213HIGHHttp4s Ember HTTP/2: unbounded outbound frame queueEPSS 0.6%CVE-2026-89407HIGHjackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoSEPSS 0.6%CVE-2026-45756HIGHSymfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoSEPSS 0.6%CVE-2026-45169HIGHIdira Privileged Access Manager (PAM) Self-Hosted Vault: Denial of Service due to Unexpected Input ProcessingEPSS 0.6%CVE-2022-23015—On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, and 14.1.2.6-14.1.4.4, when a Client SSL profile is configured on a virtual sEPSS 0.6%CVE-2024-10110HIGHDenial of Service in aimhubio/aimEPSS 0.6%CVE-2024-33498MEDIUMA vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating ManageEPSS 0.6%CVE-2026-25819HIGHHMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 alEPSS 0.6%CVE-2025-60536HIGHAn issue in the Configure New Cluster interface of kafka-ui v0.6.0 to v0.7.2 allows attackers to cause a Denial of Service (DoS) via uploadiEPSS 0.6%CVE-2023-22664HIGHBIG-IP HTTP/2 profile vulnerabilityEPSS 0.6%CVE-2026-24001LOWjsdiff has a Denial of Service vulnerability in parsePatch and applyPatchEPSS 0.6%CVE-2026-42005MEDIUMInsufficient input validation of internal web serverEPSS 0.6%CVE-2023-28644MEDIUMReference fetch can saturate the server bandwidth for 10 seconds in nextcloud serverEPSS 0.6%CVE-2024-10912HIGHDenial of Service in lm-sys/fastchatEPSS 0.6%CVE-2025-3016MEDIUMOpen Asset Import Library Assimp MDL File MDLMaterialLoader.cpp ParseTextureColorData resource consumptionEPSS 0.6%