Fallos del tipo CWE-407

119 resultados

Complexidade algorítmica ineficiente

É quando o código usa um algoritmo cuja complexidade computacional cresce desproporcionalmente com o tamanho da entrada, permitindo que um atacante consuma recursos (CPU, memória, tempo) enviando dados malformados ou massivos. O perigo: negação de serviço (DoS) ou travamento da aplicação sem necessidade de exploração de bugs clássicos.

Ejemplo

Uma API que processa lista de usuários com dois loops aninhados (O(n²)) em vez de usar hash ou índice. Um atacante envia 10 mil usuários e a operação que demoraria milissegundos passa a levar minutos, derrubando o servidor.

Cómo mitigar

Escolha algoritmos eficientes (use estruturas de dados apropriadas: hash, árvores balanceadas); implemente limites de entrada (validar tamanho máximo de listas, strings); monitore tempo de execução e aborte operações que excedem threshold; teste performance com dados grandes durante development.

CVE-2026-41292MEDIUMLong list of incoming EDNS options degrades performanceEPSS 0.6%CVE-2023-36810MEDIUMQuadratic runtime with malformed PDF missing xref marker in pypdfEPSS 0.6%CVE-2026-43967HIGHQuadratic fragment-name uniqueness check causes denial of service in absintheEPSS 0.6%CVE-2024-8237MEDIUMInefficient Algorithmic Complexity in GitLabEPSS 0.6%CVE-2024-11828MEDIUMInefficient Algorithmic Complexity in GitLabEPSS 0.6%CVE-2024-8177MEDIUMInefficient Algorithmic Complexity in GitLabEPSS 0.6%CVE-2026-42504HIGHQuadratic complexity in WordDecoder.DecodeHeader in mimeEPSS 0.6%CVE-2025-23020MEDIUMAn issue was discovered in Kwik before 0.10.1. A hash collision vulnerability (in the hash table used to manage connections) allows remote aEPSS 0.6%CVE-2024-39702MEDIUMIn lj_str_hash.c in OpenResty 1.19.3.1 through 1.25.3.1, the string hashing function (used during string interning) allows HashDoS (Hash DenEPSS 0.6%CVE-2025-29908MEDIUMNetty QUIC hash collision DoS attackEPSS 0.5%CVE-2025-24946MEDIUMThe hash table used to manage connections in picoquic before b80fd3f uses a weak hash function, allowing remote attackers to cause a consideEPSS 0.5%CVE-2026-27903HIGHminimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsEPSS 0.5%CVE-2026-3276MEDIUMPotential DoS via quadratic complexity in unicodedata.normalize()EPSS 0.5%CVE-2026-40476MEDIUMgraphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validationEPSS 0.5%CVE-2026-3988HIGHInefficient Algorithmic Complexity in GitLabEPSS 0.5%CVE-2026-34827HIGHRack: Algorithmic-Complexity DoS in Rack::Multipart::ParserEPSS 0.5%CVE-2026-59094HIGHPathway - Unauthenticated Denial of Service via Exponential Glob Pattern Matching in Document StoreEPSS 0.5%CVE-2026-34573HIGHParse Server: GraphQL complexity validator exponential fragment traversal DoSEPSS 0.5%CVE-2026-45186LOWIn libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crEPSS 0.4%CVE-2026-45664MEDIUMImageMagick: Policy Bypass in MNG coder couldEPSS 0.4%