Falhas do tipo CWE-407

270 resultados

Complexidade algorítmica ineficiente

É quando um algoritmo consome recursos (CPU, memória) de forma desproporcional à quantidade de dados que processa, geralmente por usar nested loops ou recursão profunda sem otimização. Um atacante explora isso enviando inputs grandes ou estruturados para sobrecarregar o servidor e causar negação de serviço.

Exemplo

Um endpoint de busca que valida entrada usando regex aninhado complexo (ReDoS) para cada caractere, ou uma API que processa uma lista de n itens com dois loops aninhados O(n²). Quando o atacante envia 10 mil registros, o servidor trava ao tentar processar em tempo viável.

Como mitigar

Analise a complexidade Big O dos algoritmos críticos durante code review, implemente timeouts e rate limiting, use estruturas de dados adequadas (hash maps em vez de arrays sequenciais), e teste com datasets grandes em homologação. Para regex, prefira engines não-catastróficas ou limite o tamanho de entrada.

CVE-2026-71848MEDIUMHono: Algorithmic Complexity DoS in Language MiddlewareEPSS 0.5%CVE-2026-45822MEDIUMdecode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and callEPSS 0.5%CVE-2026-42772MEDIUMPotential CPU DoS via O(n^2) Fragment Reassembly in QUICEPSS 0.5%CVE-2026-34827HIGHRack: Algorithmic-Complexity DoS in Rack::Multipart::ParserEPSS 0.5%CVE-2026-86428HIGHcommonmark 1.5.0 before 2.10.0 Denial of Service via AttributesEPSS 0.5%CVE-2026-58059HIGHQuadratic-time escaping when stringifying X.500 distinguished namesEPSS 0.5%CVE-2026-86430HIGHleague/commonmark before 2.9.1 Denial of Service via parsingEPSS 0.5%CVE-2026-86435HIGHcommonmark 1.5.0 before 2.8.4 Denial of Service via FootnoteEPSS 0.5%CVE-2024-58382HIGHleague/commonmark before 2.6.0 Denial of Service via Quadratic ComplexityEPSS 0.5%CVE-2026-73643HIGHjs-yaml: Exponential parsing time in the flow collections leads to denial of serviceEPSS 0.5%CVE-2026-3988HIGHInefficient Algorithmic Complexity in GitLabEPSS 0.5%CVE-2026-3276MEDIUMPotential DoS via quadratic complexity in unicodedata.normalize()EPSS 0.5%CVE-2026-110688HIGHCpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parseEPSS 0.5%CVE-2026-84429MEDIUMPotential denial-of-service vulnerability in HTTP header parsingEPSS 0.5%CVE-2026-65623HIGHQuadratic CPU blow-up reassembling fragmented WebSocket messages in BanditEPSS 0.5%CVE-2026-19668MEDIUMResource Exhaustion via Excessive DNSSEC Cryptographic Material MatchingEPSS 0.5%CVE-2026-45186LOWIn libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crEPSS 0.5%CVE-2026-69184HIGHc-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chainsEPSS 0.5%CVE-2026-116133HIGHHTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundaryEPSS 0.5%CVE-2026-114141HIGHtoml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()EPSS 0.5%