Falhas do tipo CWE-400

3.007 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2025-3985MEDIUMApereo CAS ResponseEntity redosEPSS 0.6%CVE-2026-9071HIGHIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by Uncontrolled Resource ConsumptionEPSS 0.6%CVE-2023-37900LOWCrossplane vulnerable to denial of service from large imageEPSS 0.6%CVE-2024-52979MEDIUMElasticsearch Uncontrolled Resource Consumption vulnerabilityEPSS 0.6%CVE-2024-23814MEDIUMThe integrated ICMP service of the network stack of affected devices can be forced to exhaust its available memory resources when receivingEPSS 0.6%CVE-2024-26369HIGHAn issue in the HistoryQosPolicy component of FastDDS v2.12.x, v2.11.x, v2.10.x, and v2.6.x leads to a SIGABRT (signal abort) upon receivingEPSS 0.6%CVE-2025-65518HIGHPlesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The vulnerability exists in the get_pasEPSS 0.6%CVE-2026-59936HIGHpypdf: Possible infinite loop for not terminated inline imagesEPSS 0.6%CVE-2026-27888MEDIUMpypdf: Manipulated FlateDecode XFA streams can exhaust RAMEPSS 0.6%CVE-2026-59937MEDIUMpypdf: Possible long runtimes for repeated malformed cross-reference entriesEPSS 0.6%CVE-2026-61387MEDIUMIn Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an uncheckeEPSS 0.6%CVE-2026-20652HIGHThe issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOSEPSS 0.6%CVE-2023-6180MEDIUMResource exhaustion via memory leak in tokio-boringEPSS 0.6%CVE-2026-55241HIGHCheckmate: Pre-auth Denial of Service via File Upload on RegistrationEPSS 0.6%CVE-2025-3112HIGHCWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause Denial of Service when an authenticated malicious user sendEPSS 0.6%CVE-2022-38734—StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0.8 are susceptible to a Denial of Service (DoS) vulnerability. A successEPSS 0.6%CVE-2026-59885HIGHpyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of serviceEPSS 0.6%CVE-2025-32472MEDIUMDoS attack by conducting a slowloris-type attackEPSS 0.6%CVE-2026-45765HIGHSuricata dnp3: unbounded reassembly can lead to resource exhaustionEPSS 0.6%CVE-2026-59884HIGHpyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDsEPSS 0.6%