Falhas do tipo CWE-400

3.026 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2026-77354HIGHkin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decodingEPSS 0.5%CVE-2026-81872MEDIUMOpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is fullEPSS 0.5%CVE-2026-83612HIGHxmldom: HTML raw-text closing-tag case mismatch causes output amplificationEPSS 0.5%CVE-2026-83606HIGHxmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructionsEPSS 0.5%CVE-2026-48125MEDIUMUAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`EPSS 0.5%CVE-2026-26233MEDIUMDenial of Service via HTTP/2 single packet attack on login endpointEPSS 0.5%CVE-2025-70071MEDIUMAn issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXParser.cpp, ParseVectorDataArray()EPSS 0.5%CVE-2026-18358HIGHGnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of serviceEPSS 0.5%CVE-2024-8626HIGHLogix Controllers Vulnerable to Denial-of-Service VulnerabilityEPSS 0.5%CVE-2026-67313MEDIUMaxios 0.28.0 before 1.18.0 Denial of Service via formDataToJSONEPSS 0.5%CVE-2026-93308MEDIUMO-RAN-SC SMO OAM VES Collector allocation of resourcesEPSS 0.5%CVE-2026-67312MEDIUMaxios 0.28.0 before 0.33.0 Denial of Service via formToJSONEPSS 0.5%CVE-2026-29856HIGHAn issue in the VirtualHost configuration handling/parser component of aaPanel v7.57.0 allows attackers to cause a Regular Expression DenialEPSS 0.5%CVE-2026-93309MEDIUMO-RAN-SC SMO OAM VES Collector allocation of resourcesEPSS 0.5%CVE-2026-56846HIGHA flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. ThiEPSS 0.5%CVE-2026-48619MEDIUMA flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on EPSS 0.5%CVE-2026-92356MEDIUMa2ui-project a2ui Update Components basic_functions.ts updateComponents resource consumptionEPSS 0.5%CVE-2024-20502MEDIUMA vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unEPSS 0.5%CVE-2024-46891MEDIUMA vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly restrict theEPSS 0.5%CVE-2026-55646MEDIUMvLLM speech-to-text endpoints allocate full upload before enforcing the audio file-size limitEPSS 0.5%