CWE-400 · 4.079 kayıt
Kontrolsüz kaynak tüketimi
Neden olur?
İç içe yapıları çözümleyen kod derinlik ya da boyut sınırı koymuyor. Küçük bir girdi orantısız işlem yüküne dönüşebilir.
Nasıl önlenir?
- 01Çözümleyicilerde derinlik, uzunluk ve süre sınırı belirleyin.
- 02Kullanıcı girdisini kayda yazmadan önce kısaltın.
- 03İşlemci ve bellek kullanımına uyarı eşiği koyun.
Hatalı ve düzeltilmiş kod
Temsili ders örneği. Vurgulu satırlar hatanın ve düzeltmenin yeridir.
Hatalı
function expand(node) {
return node.children.map(expand);
}Düzeltilmiş
const MAX_DEPTH = 32;
function expand(node, depth = 0) {
if (depth > MAX_DEPTH) throw new Error("çok derin");
return node.children.map((c) => expand(c, depth + 1));
}Kodunuzda bu kalıp var mı?
Kaynak kod analizi kapsamında bu sınıfı özellikle arıyoruz. Bulgular satır numarasıyla teslim edilir.
Bu sınıftaki CVE’ler
4.086 kayıt
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
90Hemen | CVE-2023-44487Silahlaştırılmış | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, assiemens · simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmware · CWE-400 | Yüksek7,5 | KEV | %99,9 | 10 Eki 2023 |
79Bu hafta | CVE-2026-45498Silahlaştırılmış | Microsoft Defender Denial of Service Vulnerabilitymicrosoft · defender antimalware platform · CWE-400 | Yüksek7,5 | KEV | %63,0 | 20 May 2026 |
74Bu hafta | CVE-2026-28318Silahlaştırılmış | SolarWinds Serv-U Unauthenticated Denial of Service Vulnerabilitysolarwinds · serv-u · CWE-400 | Yüksek7,5 | KEV | %48,0 | 4 Haz 2026 |
65Bu hafta | CVE-2020-3566Silahlaştırılmış | Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilitycisco · ios xr · CWE-400 | Yüksek8,6 | KEV | %3,7 | 29 Ağu 2020 |
65Bu hafta | CVE-2020-3569Silahlaştırılmış | Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilitiescisco · ios xr · CWE-400 | Yüksek8,6 | KEV | %3,3 | 22 Eyl 2020 |
64Bu hafta | CVE-2023-38180Silahlaştırılmış | .NET and Visual Studio Denial of Service Vulnerabilitymicrosoft · .net · CWE-400 | Yüksek7,5 | KEV | %14,1 | 8 Ağu 2023 |
61Bu hafta | CVE-2011-3192Silahlaştırılmış | The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a deniapache · http server · CWE-400 | Yüksek7,8 | — | %98,9 | 29 Ağu 2011 |
60Bu hafta | CVE-2018-1000115Silahlaştırılmış | Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDPmemcached · memcached · CWE-400 | Yüksek7,5 | — | %88,0 | 5 Mar 2018 |
60Bu hafta | CVE-2019-5645Silahlaştırılmış | Rapid7 Metasploit HTTP Handler Denial of Servicerapid7 · metasploit · CWE-400 | Yüksek7,5 | — | %49,1 | 1 Eyl 2020 |
60Bu hafta | CVE-2017-16086Silahlaştırılmış | ua-parser is a port of Browserscope's user agent parser.ua-parser project · ua-parser · CWE-400 | Yüksek7,5 | — | %9,1 | 6 Haz 2018 |
60Bu hafta | CVE-2016-10542Silahlaştırılmış | ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455".ws project · ws · CWE-400 | Yüksek7,5 | — | %7,2 | 31 May 2018 |
60Bu hafta | CVE-2004-1464Silahlaştırılmış | Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a crafcisco · ios · CWE-400 | Orta5,9 | KEV | %4,8 | 31 Ara 2004 |
57Planlayın | CVE-2023-45288Kavram kanıtı | HTTP/2 CONTINUATION flood in net/httpgo standard library · net/http · CWE-400 | Yüksek7,5 | — | %89,4 | 4 Nis 2024 |
56Planlayın | CVE-2019-9515İstismar yok | Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of serviceapple · swiftnio · CWE-400 | Yüksek7,5 | — | %87,2 | 13 Ağu 2019 |
55Planlayın | CVE-2019-9512İstismar yok | Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of serviceapple · swiftnio · CWE-400 | Yüksek7,5 | — | %83,4 | 13 Ağu 2019 |
55Planlayın | CVE-2019-9514İstismar yok | Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of serviceapple · swiftnio · CWE-400 | Yüksek7,5 | — | %82,8 | 13 Ağu 2019 |
54Planlayın | CVE-2019-9513Kavram kanıtı | Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of serviceapple · swiftnio · CWE-400 | Yüksek7,5 | — | %81,5 | 13 Ağu 2019 |
54Planlayın | CVE-2023-28342İstismar yok | Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API.zohocorp · manageengine adselfservice plus · CWE-400 | Yüksek7,5 | — | %78,3 | 5 Nis 2023 |
53Planlayın | CVE-2021-21341Kavram kanıtı | XStream can cause a Denial of Servicexstream · xstream · CWE-400 | Yüksek7,5 | — | %77,8 | 23 Mar 2021 |
53Planlayın | CVE-2003-0714Silahlaştırılmış | The Internet Mail Service in Exchange Server 5.5 and Exchange 2000 allows remote attackers to cause a denial of service (memory exhaustion) microsoft · exchange server · CWE-400 | Yüksek7,5 | — | %77,6 | 17 Kas 2003 |
53Planlayın | CVE-2021-22883İstismar yok | Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an nodejs · node.js · CWE-400 | Yüksek7,5 | — | %77,3 | 3 Mar 2021 |
52Planlayın | CVE-2023-50868Kavram kanıtı | The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a dennetapp · hci baseboard management controller · CWE-400 | Yüksek7,5 | — | %74,2 | 14 Şub 2024 |
52Planlayın | CVE-2022-29885Kavram kanıtı | EncryptInterceptor does not provide complete protection on insecure networksapache · tomcat · CWE-400 | Yüksek7,5 | — | %73,4 | 12 May 2022 |
52Planlayın | CVE-2019-0199İstismar yok | The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS framesapache · tomcat · CWE-400 | Yüksek7,5 | — | %72,8 | 10 Nis 2019 |
52Planlayın | CVE-2017-3144İstismar yok | Failure to properly clean up closed OMAPI connections can exhaust available socketsisc · dhcp · CWE-400 | Yüksek7,5 | — | %72,7 | 16 Oca 2019 |
- CVE-2023-4448790Hemen
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as
YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %99siemens · simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmware10 Eki 2023
- CVE-2026-4549879Bu hafta
Microsoft Defender Denial of Service Vulnerability
YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %63microsoft · defender antimalware platform20 May 2026
- CVE-2026-2831874Bu hafta
SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability
YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %48solarwinds · serv-u4 Haz 2026
- CVE-2020-356665Bu hafta
Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability
YüksekCVSS 8,6KEVSilahlaştırılmışEPSS %3cisco · ios xr29 Ağu 2020
- CVE-2020-356965Bu hafta
Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities
YüksekCVSS 8,6KEVSilahlaştırılmışEPSS %3cisco · ios xr22 Eyl 2020
- CVE-2023-3818064Bu hafta
.NET and Visual Studio Denial of Service Vulnerability
YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %14microsoft · .net8 Ağu 2023
- CVE-2011-319261Bu hafta
The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a deni
YüksekCVSS 7,8SilahlaştırılmışEPSS %98apache · http server29 Ağu 2011
- CVE-2018-100011560Bu hafta
Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP
YüksekCVSS 7,5SilahlaştırılmışEPSS %88memcached · memcached5 Mar 2018
- CVE-2019-564560Bu hafta
Rapid7 Metasploit HTTP Handler Denial of Service
YüksekCVSS 7,5SilahlaştırılmışEPSS %49rapid7 · metasploit1 Eyl 2020
- CVE-2017-1608660Bu hafta
ua-parser is a port of Browserscope's user agent parser.
YüksekCVSS 7,5SilahlaştırılmışEPSS %9ua-parser project · ua-parser6 Haz 2018
- CVE-2016-1054260Bu hafta
ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455".
YüksekCVSS 7,5SilahlaştırılmışEPSS %7ws project · ws31 May 2018
- CVE-2004-146460Bu hafta
Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a craf
OrtaCVSS 5,9KEVSilahlaştırılmışEPSS %4cisco · ios31 Ara 2004
- CVE-2023-4528857Planlayın
HTTP/2 CONTINUATION flood in net/http
YüksekCVSS 7,5Kavram kanıtıEPSS %89go standard library · net/http4 Nis 2024
- CVE-2019-951556Planlayın
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service
YüksekCVSS 7,5İstismar yokEPSS %87apple · swiftnio13 Ağu 2019
- CVE-2019-951255Planlayın
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service
YüksekCVSS 7,5İstismar yokEPSS %83apple · swiftnio13 Ağu 2019
- CVE-2019-951455Planlayın
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service
YüksekCVSS 7,5İstismar yokEPSS %82apple · swiftnio13 Ağu 2019
- CVE-2019-951354Planlayın
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service
YüksekCVSS 7,5Kavram kanıtıEPSS %81apple · swiftnio13 Ağu 2019
- CVE-2023-2834254Planlayın
Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API.
YüksekCVSS 7,5İstismar yokEPSS %78zohocorp · manageengine adselfservice plus5 Nis 2023
- CVE-2021-2134153Planlayın
XStream can cause a Denial of Service
YüksekCVSS 7,5Kavram kanıtıEPSS %77xstream · xstream23 Mar 2021
- CVE-2003-071453Planlayın
The Internet Mail Service in Exchange Server 5.5 and Exchange 2000 allows remote attackers to cause a denial of service (memory exhaustion)
YüksekCVSS 7,5SilahlaştırılmışEPSS %77microsoft · exchange server17 Kas 2003
- CVE-2021-2288353Planlayın
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an
YüksekCVSS 7,5İstismar yokEPSS %77nodejs · node.js3 Mar 2021
- CVE-2023-5086852Planlayın
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a den
YüksekCVSS 7,5Kavram kanıtıEPSS %74netapp · hci baseboard management controller14 Şub 2024
- CVE-2022-2988552Planlayın
EncryptInterceptor does not provide complete protection on insecure networks
YüksekCVSS 7,5Kavram kanıtıEPSS %73apache · tomcat12 May 2022
- CVE-2019-019952Planlayın
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames
YüksekCVSS 7,5İstismar yokEPSS %72apache · tomcat10 Nis 2019
- CVE-2017-314452Planlayın
Failure to properly clean up closed OMAPI connections can exhaust available sockets
YüksekCVSS 7,5İstismar yokEPSS %72isc · dhcp16 Oca 2019