Weaknesses of type CWE-1325

22 results

Alocação sequencial de memória sem controle apropriado

Ocorre quando um programa aloca blocos de memória de forma sequencial sem validar tamanhos, quantidades ou limites totais, permitindo que um atacante force alocações excessivas. Um loop que aloca memória baseado em entrada do usuário sem teto causa esgotamento de recursos ou corrupção de heap.

Example

Uma aplicação web processa um arquivo com múltiplos registros e aloca um buffer para cada um sem verificar o número total. Um atacante envia um arquivo com milhões de registros, causando Denial of Service por consumo descontrolado de RAM ou travamento do processo.

How to mitigate

Implemente limites estritos: máximo de iterações, tamanho máximo por alocação, e limite total de memória consumida. Valide entrada antes de usar em cálculos de alocação e considere usar pool de memória pré-alocado ou estruturas com capacidade máxima definida.

CVE-2024-2511MEDIUMUnbounded memory growth with session handling in TLSv1.3EPSS 52.4%CVE-2023-3341HIGHA stack exhaustion flaw in control channel code may cause named to terminate unexpectedlyEPSS 2.9%CVE-2024-27804HIGHThe issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionEPSS 1.3%CVE-2021-43174—gzip transfer encoding caused out-of-memory crashEPSS 1.2%CVE-2025-2240HIGHSmallrye-fault-tolerance: smallrye fault toleranceEPSS 1.0%CVE-2026-34183HIGHUnbounded Memory Growth in the QUIC PATH_CHALLENGE HandlerEPSS 0.8%CVE-2026-71436MEDIUMMermaid XY Charts are vulnerable to an infinite loop DoSEPSS 0.6%CVE-2023-28968MEDIUMJunos OS: SRX Series: Policies that rely on JDPI-Decoder actions may fail openEPSS 0.6%CVE-2026-54081MEDIUMveraPDF Parser DoS via PostScript Type 1 Font ProgramsEPSS 0.5%CVE-2026-54080MEDIUMveraPDF Parser DoS via PostScript CMap StreamsEPSS 0.5%CVE-2023-52891MEDIUMA vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.5), SIMATIC Energy Manager PRO (All versions < V7.5),EPSS 0.5%CVE-2026-8199HIGHPost-auth memory exhaustion via bitwise match expressionsEPSS 0.5%CVE-2026-24819MEDIUMAn out-of-memory (OOM) issue in foxinmy/weixin4jEPSS 0.4%CVE-2026-13056HIGHA user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAMEPSS 0.4%CVE-2026-18772MEDIUMImproperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion.EPSS 0.4%CVE-2026-3201MEDIUMImproperly Controlled Sequential Memory Allocation in WiresharkEPSS 0.3%CVE-2024-27796HIGHThe issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey EPSS 0.3%CVE-2026-6533MEDIUMImproperly Controlled Sequential Memory Allocation in WiresharkEPSS 0.2%CVE-2026-6535MEDIUMImproperly Controlled Sequential Memory Allocation in WiresharkEPSS 0.2%CVE-2025-13945MEDIUMImproperly Controlled Sequential Memory Allocation in WiresharkEPSS 0.2%