Fallos del tipo CWE-407

120 resultados

Complexidade algorítmica ineficiente

É quando o código usa um algoritmo cuja complexidade computacional cresce desproporcionalmente com o tamanho da entrada, permitindo que um atacante consuma recursos (CPU, memória, tempo) enviando dados malformados ou massivos. O perigo: negação de serviço (DoS) ou travamento da aplicação sem necessidade de exploração de bugs clássicos.

Ejemplo

Uma API que processa lista de usuários com dois loops aninhados (O(n²)) em vez de usar hash ou índice. Um atacante envia 10 mil usuários e a operação que demoraria milissegundos passa a levar minutos, derrubando o servidor.

Cómo mitigar

Escolha algoritmos eficientes (use estruturas de dados apropriadas: hash, árvores balanceadas); implemente limites de entrada (validar tamanho máximo de listas, strings); monitore tempo de execução e aborte operações que excedem threshold; teste performance com dados grandes durante development.

CVE-2026-45664MEDIUMImageMagick: Policy Bypass in MNG coder couldEPSS 0.4%CVE-2026-58226HIGHUnauthenticated denial-of-service via unbounded HPACK integer decoding in hpaxEPSS 0.4%CVE-2026-42304HIGHTwisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer ChainsEPSS 0.4%CVE-2026-59880HIGHImmutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/SetEPSS 0.4%CVE-2026-34230MEDIUMRack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding headerEPSS 0.4%CVE-2026-59869HIGHjs-yaml: YAML merge-key chains can force quadratic CPU consumptionEPSS 0.4%CVE-2026-71321HIGHNuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validationEPSS 0.4%CVE-2026-59922HIGHMistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)EPSS 0.4%CVE-2026-59928HIGHMistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitionsEPSS 0.4%CVE-2026-59925HIGHinline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairsEPSS 0.4%CVE-2026-49293HIGHCPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literalsEPSS 0.4%CVE-2026-59870MEDIUMjs-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsingEPSS 0.4%CVE-2026-42245LOWnet-imap: Quadratic complexity when reading response literalsEPSS 0.4%CVE-2026-59868MEDIUMjs-yaml: YAML merge-key chains can force quadratic CPU consumptionEPSS 0.4%CVE-2026-28804MEDIUMpypdf: Inefficient decoding of ASCIIHexDecode streamsEPSS 0.4%CVE-2026-65623HIGHQuadratic CPU blow-up reassembling fragmented WebSocket messages in BanditEPSS 0.4%CVE-2026-53539HIGHPython-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of serviceEPSS 0.4%CVE-2026-53550MEDIUMjs-yaml: Quadratic-complexity DoS in merge key handling via repeated aliasesEPSS 0.4%CVE-2026-48959HIGHIO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForwardEPSS 0.4%CVE-2026-40164HIGHjq: Algorithmic complexity DoS via hardcoded MurmurHash3 seedEPSS 0.4%