Fallos del tipo CWE-407

120 resultados

Complexidade algorítmica ineficiente

É quando o código usa um algoritmo cuja complexidade computacional cresce desproporcionalmente com o tamanho da entrada, permitindo que um atacante consuma recursos (CPU, memória, tempo) enviando dados malformados ou massivos. O perigo: negação de serviço (DoS) ou travamento da aplicação sem necessidade de exploração de bugs clássicos.

Ejemplo

Uma API que processa lista de usuários com dois loops aninhados (O(n²)) em vez de usar hash ou índice. Um atacante envia 10 mil usuários e a operação que demoraria milissegundos passa a levar minutos, derrubando o servidor.

Cómo mitigar

Escolha algoritmos eficientes (use estruturas de dados apropriadas: hash, árvores balanceadas); implemente limites de entrada (validar tamanho máximo de listas, strings); monitore tempo de execução e aborte operações que excedem threshold; teste performance com dados grandes durante development.

CVE-2025-14550HIGHPotential denial-of-service vulnerability via repeated headers when using ASGIEPSS 1.0%CVE-2023-22484LOWInefficient Quadratic complexity bug in handle_pointy_brace may lead to a denial of serviceEPSS 1.0%CVE-2022-22153HIGHSRX Series and MX Series with SPC3: A high percentage of fragments might lead to high latency or packet dropsEPSS 0.9%CVE-2023-2473MEDIUMDreamer CMS Password Hash Calculation UserController.java updatePwd algorithmic complexityEPSS 0.9%CVE-2024-23684HIGHupokecenter CBOR Denial of ServiceEPSS 0.9%CVE-2026-33033MEDIUMPotential denial-of-service vulnerability in MultiPartParser via base64-encoded file uploadEPSS 0.9%CVE-2020-3548MEDIUMCisco Email Security Appliance Denial Of Service VulnerabilityEPSS 0.8%CVE-2025-12084MEDIUMQuadratic complexity in node ID cache clearingEPSS 0.8%CVE-2025-27209HIGHThe V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HasEPSS 0.8%CVE-2024-8233HIGHInefficient Algorithmic Complexity in GitLabEPSS 0.8%CVE-2024-6324MEDIUMInefficient Algorithmic Complexity in GitLabEPSS 0.7%CVE-2024-9631HIGHInefficient Algorithmic Complexity in GitLabEPSS 0.7%CVE-2026-54892HIGHPlug: quadratic-time decoding of nested query/body parameters enables denial of serviceEPSS 0.7%CVE-2025-11230HIGHDenial of service vulnerability in HAProxy mjson libraryEPSS 0.7%CVE-2026-55685HIGHReact Router: Unauthenticated Denial of Service via Inefficient Route MatchingEPSS 0.7%CVE-2026-64644MEDIUMNext.js: Denial of Service in the Image Optimization API using SVGsEPSS 0.7%CVE-2025-24947MEDIUMA hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attaEPSS 0.6%CVE-2025-62727HIGHStarlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponseEPSS 0.6%CVE-2025-14831MEDIUMGnutls: gnutls: denial of service via excessive resource consumption during certificate verificationEPSS 0.6%CVE-2023-36810MEDIUMQuadratic runtime with malformed PDF missing xref marker in pypdfEPSS 0.6%