Falhas do tipo CWE-400

2.621 resultados

Consumo não controlado de recursos

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições ou eventos, permitindo que um atacante esgote os recursos disponíveis. Resultado: negação de serviço, travamento ou crash da aplicação.

Exemplo

Um servidor web que aceita uploads sem limite de tamanho permite que um atacante envie um arquivo gigante, preenchendo o disco e derrubando o serviço. Outro cenário: aceitar conexões TCP indefinidamente sem timeout, até esgotar o número máximo de sockets do sistema operacional.

Como mitigar

Implemente limites explícitos: tamanho máximo de requisição/arquivo, timeout de conexão, limite de memória por processo, rate limiting. Use filas com capacidade máxima e rejeite requisições excedentes com mensagem de erro clara (HTTP 429, por exemplo).

CVE-2020-8277—A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versiEPSS 54.2%CVE-2021-28165HIGHIn Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invaEPSS 53.9%CVE-2026-49160HIGHHTTP.sys Denial of Service VulnerabilityEPSS 53.8%CVE-2022-31698MEDIUMThe vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port EPSS 47.8%CVE-2024-5011HIGHWhatsUp Gold TestController Chart denial of service vulnerabilityEPSS 47.1%CVE-2018-16843MEDIUMnginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption.EPSS 47.1%CVE-2020-2039MEDIUMPAN-OS: Management web interface denial-of-service (DoS) through unauthenticated file uploadEPSS 46.4%CVE-2019-5645HIGHRapid7 Metasploit HTTP Handler Denial of ServiceEPSS 41.7%CVE-2018-12122—Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial EPSS 41.3%CVE-2016-8610—A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processiEPSS 39.7%CVE-2017-6019—An issue was discovered in Schneider Electric Conext ComBox, model 865-1058, all firmware versions prior to V3.03 BN 830. A series of rapid EPSS 36.9%CVE-2018-5391—The Linux kernel, versions 3.9+, IP implementation is vulnerable to denial of service conditions with low rates of specially modified packetsEPSS 32.4%CVE-2016-8858HIGHThe kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consEPSS 29.5%CVE-2019-9517HIGHSome HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of serviceEPSS 27.9%CVE-2023-23590HIGHMercedes-Benz XENTRY Retail Data Storage 7.8.1 allows remote attackers to cause a denial of service (device restart) via an unauthenticated EPSS 26.4%CVE-2019-9518HIGHSome HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of serviceEPSS 25.4%CVE-2026-34648HIGHAdobe Commerce | Uncontrolled Resource Consumption (CWE-400)EPSS 22.6%CVE-2026-0599HIGHUnbounded External Image Fetch in Validation Leads to Resource-Exhaustion DoS in huggingface/text-generation-inferenceEPSS 22.5%CVE-2017-0938—Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplificatiEPSS 21.0%CVE-2025-67779HIGHIt was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attacEPSS 19.5%