Weaknesses of type CWE-833

25 results

Negação de Serviço (DoS)

Uma fraqueza que permite a um atacante consumir recursos da aplicação (CPU, memória, conexões) de forma descontrolada, tornando o serviço indisponível para usuários legítimos. O código falha em validar, limitar ou proteger operações que podem ser exploradas para exauri o sistema.

Example

Uma API que processa requisições sem limite de taxa (rate limiting) permite que um atacante envie milhares de solicitações simultâneas, esgotando conexões de banco de dados e derrubando o serviço. Ou um loop recursivo sem limite de profundidade que pode ser acionado por entrada do usuário, consumindo toda a memória disponível.

How to mitigate

Implemente controles de limite (rate limiting, throttling), valide e restrinja entrada do usuário (tamanho máximo, profundidade, loops), use timeouts em operações custosas, e monitore consumo de recursos para detectar picos anormais. Arquitete com filas, circuit breakers e auto-scaling quando apropriado.

CVE-2025-21313MEDIUMWindows Security Account Manager (SAM) Denial of Service VulnerabilityEPSS 1.6%CVE-2021-1622HIGHCisco IOS XE Software for Cisco cBR-8 Converged Broadband Routers Common Open Policy Service Denial of Service VulnerabilityEPSS 1.0%CVE-2022-43767HIGHA vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-EPSS 0.7%CVE-2025-1713HIGHdeadlock potential with VT-d and legacy PCI device pass-throughEPSS 0.7%CVE-2026-44579HIGHNext.js: Denial of Service via connection exhaustion in applications using Cache ComponentsEPSS 0.7%CVE-2024-8447MEDIUMNarayana: deadlock via multiple join requests sent to lra coordinatorEPSS 0.6%CVE-2024-29172MEDIUMDell BSAFE SSL-J, versions prior to 6.6 and versions 7.0 through 7.2, contains a deadlock vulnerability. A remote attacker could potentiallyEPSS 0.4%CVE-2023-42441MEDIUMVyper has incorrect re-entrancy lock when key is empty stringEPSS 0.4%CVE-2023-31084MEDIUMAn issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TEPSS 0.4%CVE-2025-54796HIGHCopyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" pageEPSS 0.4%CVE-2025-59463MEDIUMDenial-of-service (DoS) via chunk size mismatchEPSS 0.4%CVE-2024-48077HIGHNanoMQ v0.22.7 is vulnerable to Denial of Service (DoS) due to improper resource throttling. A crafted sequence of requests causes the recv-EPSS 0.3%CVE-2025-8312HIGHDeadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain valid beyond the end of its intended check-out EPSS 0.3%CVE-2023-0160MEDIUMPossibility of deadlock in libbpf function sock_hash_delete_elemEPSS 0.3%CVE-2024-47506HIGHJunos OS: SRX Series: A large amount of traffic being processed by ATP Cloud can lead to a PFE crashEPSS 0.3%CVE-2025-10150HIGHWebserver crash caused by scanning on TCP port 80EPSS 0.2%CVE-2025-36010MEDIUMIBM Db2 for Linux denial of serviceEPSS 0.2%CVE-2026-10647MEDIUMDeadlock denial of service in USB CDC-NCM device class on TX enqueue failureEPSS 0.2%CVE-2022-4269MEDIUMA flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets tEPSS 0.2%CVE-2026-70616HIGHboringproxy 0.10.0 Resource Exhaustion DoS via GET /loading endpointEPSS 0.2%