Fallos del tipo CWE-400

2621 resultados

Consumo descontrolado de recursos (esgotamento)

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições do usuário ou eventos externos. Um atacante explora isso enviando muitas requisições ou dados grandes para derrubar o serviço, indisponibilizando-o para usuários legítimos.

Ejemplo

Um endpoint de upload aceita arquivos sem limitar o tamanho ou taxa de envio; um atacante manda gigabytes contínuos até a aplicação ficar sem espaço em disco ou memória. Ou um loop sem condição de parada processa dados de entrada indefinidamente, travando a CPU.

Cómo mitigar

Implemente limites explícitos: tamanho máximo de arquivo/requisição, rate limiting (requisições por IP/usuário), timeouts, pool de conexões com tamanho fixo, e monitoramento de recursos. Valide e rejeite early entradas que excedem esses limites.

CVE-2021-44228CRITICALApache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsEPSS 100.0%KEVCVE-2023-44487HIGHThe HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, asEPSS 100.0%KEVCVE-2024-25617MEDIUMDenial of Service in HTTP Header parser in squid proxyEPSS 88.9%CVE-2019-9515HIGHSome HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of serviceEPSS 87.4%CVE-2019-9512HIGHSome HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of serviceEPSS 83.4%CVE-2019-9514HIGHSome HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of serviceEPSS 82.8%CVE-2023-50868HIGHThe Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denEPSS 81.7%CVE-2019-9513HIGHSome HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of serviceEPSS 81.6%CVE-2023-28342HIGHZoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API.EPSS 78.3%CVE-2021-21341HIGHXStream can cause a Denial of ServiceEPSS 77.8%CVE-2021-22883—Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an EPSS 74.4%CVE-2018-5390—Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of serviceEPSS 73.7%CVE-2022-29885—EncryptInterceptor does not provide complete protection on insecure networksEPSS 73.5%CVE-2023-43622—Apache HTTP Server: DoS in HTTP/2 with initial windows size 0EPSS 70.6%CVE-2023-36606HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 67.2%CVE-2026-45498MEDIUMMicrosoft Defender Denial of Service VulnerabilityEPSS 63.1%KEVCVE-2024-26212HIGHDHCP Server Service Denial of Service VulnerabilityEPSS 62.6%CVE-2023-24580HIGHAn issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certaiEPSS 62.6%CVE-2019-9511HIGHSome HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of serviceEPSS 59.5%CVE-2019-9516HIGHSome HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of serviceEPSS 56.3%