Falhas do tipo CWE-407

270 resultados

Complexidade algorítmica ineficiente

É quando um algoritmo consome recursos (CPU, memória) de forma desproporcional à quantidade de dados que processa, geralmente por usar nested loops ou recursão profunda sem otimização. Um atacante explora isso enviando inputs grandes ou estruturados para sobrecarregar o servidor e causar negação de serviço.

Exemplo

Um endpoint de busca que valida entrada usando regex aninhado complexo (ReDoS) para cada caractere, ou uma API que processa uma lista de n itens com dois loops aninhados O(n²). Quando o atacante envia 10 mil registros, o servidor trava ao tentar processar em tempo viável.

Como mitigar

Analise a complexidade Big O dos algoritmos críticos durante code review, implemente timeouts e rate limiting, use estruturas de dados adequadas (hash maps em vez de arrays sequenciais), e teste com datasets grandes em homologação. Para regex, prefira engines não-catastróficas ou limite o tamanho de entrada.

CVE-2026-94653HIGHApache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)EPSS 0.3%CVE-2026-55206HIGHpy7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()EPSS 0.3%CVE-2026-65634HIGHSuperlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoderEPSS 0.3%CVE-2026-71491HIGHsqlparse: Quadratic O(n²) DoS in group_commentsEPSS 0.3%CVE-2026-107580MEDIUMInefficient Algorithmic Complexity in hMailServerEPSS 0.3%CVE-2026-107582MEDIUMInefficient Algorithmic Complexity in hMailServerEPSS 0.3%CVE-2026-107583MEDIUMInefficient Algorithmic Complexity in hMailServerEPSS 0.3%CVE-2026-114129MEDIUMstream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of serviceEPSS 0.3%CVE-2025-55304LOWExiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadataEPSS 0.3%CVE-2026-107581MEDIUMInefficient Algorithmic Complexity in hMailServerEPSS 0.2%CVE-2026-6042MEDIUMmusl libc GB18030 4-byte Decoder iconv.c iconv algorithmic complexityEPSS 0.2%CVE-2026-65631MEDIUMerlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of serviceEPSS 0.2%CVE-2026-95838MEDIUMcontainerd: Unpack DoS via repeated opaque whiteoutsEPSS 0.2%CVE-2025-66382LOWIn libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.EPSS 0.2%CVE-2026-104182MEDIUMstream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunkEPSS 0.2%CVE-2026-8594MEDIUMText::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break charactersEPSS 0.2%CVE-2026-87768HIGHDateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding secondsEPSS 0.2%CVE-2026-84305MEDIUMsqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumptionEPSS 0.2%CVE-2026-77831LOWAlgorithmic-complexity denial of service in AshPaperTrail full-diff list trackingEPSS 0.2%CVE-2026-106554—jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)EPSS 0.2%