Falhas do tipo CWE-400

3.026 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2026-50125HIGHMKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory ExhaustionEPSS 0.5%CVE-2026-31958HIGHTornado has a DoS due to too many multipart partsEPSS 0.5%CVE-2026-44435HIGHQuicly: Remote Denial of Service via assertion failure when CRYPTO stream handshake data exceeds 32KBEPSS 0.5%CVE-2026-86250HIGHh3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked CookieEPSS 0.5%CVE-2024-51316HIGHThe Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name function of the file /goform/SetOnlineDevNaEPSS 0.5%CVE-2026-5079HIGHmulter vulnerable to Denial of Service via deeply nested field namesEPSS 0.5%CVE-2026-67976HIGHThe Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user-controlled parameters, allowing attackers to caEPSS 0.5%CVE-2026-9675HIGHundici WebSocket client vulnerable to denial of service via cumulative fragment bypassEPSS 0.5%CVE-2026-30350HIGHAn issue in the /store/items/search endpoint of Agent Protocol server commit e9a89f allows attackers to cause a Denial of Service (DoS) via EPSS 0.5%CVE-2026-47249HIGHKlever-Go KVM: Hash-array amplification in P2P resolver request handlingEPSS 0.5%CVE-2026-62296HIGHHAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of serviceEPSS 0.5%CVE-2026-91941HIGHCrawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategyEPSS 0.5%CVE-2026-51535HIGHIn OpENer 2.3.0 (commit 76b95cf), a resource exhaustion (Denial of Service) vulnerability exists in its network processing loop.EPSS 0.5%CVE-2026-45820MEDIUMfflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory EPSS 0.5%CVE-2026-71646HIGHAn issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause a denial EPSS 0.5%CVE-2026-57081HIGHNet::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply nested bencoded inputEPSS 0.5%CVE-2026-52879HIGHKlever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoSEPSS 0.5%CVE-2026-92942HIGHvm2 before 3.11.7 Timeout Bypass via FinalizationRegistryEPSS 0.5%CVE-2026-44892HIGHNetty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header SizeEPSS 0.5%CVE-2026-94449HIGHQuarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of serviceEPSS 0.5%