Falhas do tipo CWE-407

115 resultados

Complexidade algorítmica ineficiente

É quando um algoritmo consome recursos (CPU, memória) de forma desproporcional à quantidade de dados que processa, geralmente por usar nested loops ou recursão profunda sem otimização. Um atacante explora isso enviando inputs grandes ou estruturados para sobrecarregar o servidor e causar negação de serviço.

Exemplo

Um endpoint de busca que valida entrada usando regex aninhado complexo (ReDoS) para cada caractere, ou uma API que processa uma lista de n itens com dois loops aninhados O(n²). Quando o atacante envia 10 mil registros, o servidor trava ao tentar processar em tempo viável.

Como mitigar

Analise a complexidade Big O dos algoritmos críticos durante code review, implemente timeouts e rate limiting, use estruturas de dados adequadas (hash maps em vez de arrays sequenciais), e teste com datasets grandes em homologação. Para regex, prefira engines não-catastróficas ou limite o tamanho de entrada.

CVE-2020-27223MEDIUMIn Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple AcceptEPSS 78.0%CVE-2022-36021MEDIUMRedis string pattern matching can be abused to achieve Denial of ServiceEPSS 59.7%CVE-2024-43485HIGH.NET and Visual Studio Denial of Service VulnerabilityEPSS 3.1%CVE-2024-43484HIGH.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityEPSS 2.9%CVE-2024-43483HIGH.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityEPSS 2.9%CVE-2022-45061HIGHAn issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDEPSS 2.4%CVE-2019-19331HIGHknot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource recoEPSS 2.2%CVE-2025-64460HIGHPotential denial-of-service vulnerability in XML serializer text extractionEPSS 2.1%CVE-2025-64458HIGHPotential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on WindowsEPSS 1.9%CVE-2022-40188HIGHKnot Resolver before 5.5.3 allows remote attackers to cause a denial of service (CPU consumption) because of algorithmic complexity. During EPSS 1.6%CVE-2023-4408HIGHParsing large DNS messages may cause excessive CPU loadEPSS 1.3%CVE-2024-12243MEDIUMGnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dosEPSS 1.2%CVE-2023-22486LOWcmark-gfm Quadratic complexity bug in handle_close_bracket may lead to a denial of serviceEPSS 1.1%CVE-2026-55968HIGHApache Thrift: Node.js quadratic-time DoS in server receive transportsEPSS 1.1%CVE-2023-46136HIGHWerkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginningEPSS 1.1%CVE-2024-12133MEDIUMLibtasn1: inefficient der decoding in libtasn1 leading to potential remote dosEPSS 1.1%CVE-2024-21909HIGHDenial of service in CBOR libraryEPSS 1.1%CVE-2023-26485MEDIUMQuadratic complexity may lead to a denial of service in cmark-gfmEPSS 1.0%CVE-2023-24824MEDIUMQuadratic complexity may lead to a denial of service in cmark-gfmEPSS 1.0%CVE-2025-14550HIGHPotential denial-of-service vulnerability via repeated headers when using ASGIEPSS 1.0%