Falhas do tipo CWE-400

3.026 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2026-19500HIGHSureForms contains an uncontrolled resource consumption vulnerabilityEPSS 0.6%CVE-2023-40593MEDIUMDenial of Service (DoS) in Splunk Enterprise Using a Malformed SAML RequestEPSS 0.6%CVE-2023-29139MEDIUMAn issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. When a user with checkuserlog permissions makes many CheckUEPSS 0.6%CVE-2026-77037HIGHmulter vulnerable to Denial of Service via file descriptor leak on aborted uploadsEPSS 0.6%CVE-2026-52192HIGHAn issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_445C5C componenEPSS 0.6%CVE-2026-26047MEDIUMMoodle: moodle: uncontrolled resource consumption in tex formula editor leading to denial of serviceEPSS 0.6%CVE-2026-52197HIGHAn issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_44af70 componenEPSS 0.6%CVE-2026-65785MEDIUMWindows DHCP Client Denial of Service VulnerabilityEPSS 0.6%CVE-2023-20882MEDIUMIn Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service ofEPSS 0.6%CVE-2026-49842HIGHFreeSWITCH: Pre-authentication bandwidth amplification via `mod_verto` speed-test framesEPSS 0.6%CVE-2024-34079LOWocto-sts allows unauthenticated attackers to cause unbounded CPU and memory usageEPSS 0.6%CVE-2026-34043MEDIUMSerialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objectsEPSS 0.6%CVE-2026-55446HIGHLangflow: Unauthenticated DoS through multipart form boundary file uploadEPSS 0.6%CVE-2026-81721HIGHopenssl_encrypt before 1.4.9 Denial of Service via KDFEPSS 0.6%CVE-2026-68497HIGHjackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of serviceEPSS 0.6%CVE-2026-52023HIGHAn issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specificalEPSS 0.6%CVE-2025-53044MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0EPSS 0.6%CVE-2025-53062MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0EPSS 0.6%CVE-2025-53045MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0EPSS 0.6%CVE-2025-53067MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.EPSS 0.6%