Weaknesses of type CWE-1325

21 results

Alocação sequencial de memória sem controle apropriado

Ocorre quando um programa aloca blocos de memória de forma sequencial sem validar tamanhos, quantidades ou limites totais, permitindo que um atacante force alocações excessivas. Um loop que aloca memória baseado em entrada do usuário sem teto causa esgotamento de recursos ou corrupção de heap.

Example

Uma aplicação web processa um arquivo com múltiplos registros e aloca um buffer para cada um sem verificar o número total. Um atacante envia um arquivo com milhões de registros, causando Denial of Service por consumo descontrolado de RAM ou travamento do processo.

How to mitigate

Implemente limites estritos: máximo de iterações, tamanho máximo por alocação, e limite total de memória consumida. Valide entrada antes de usar em cálculos de alocação e considere usar pool de memória pré-alocado ou estruturas com capacidade máxima definida.

CVE-2024-2511MEDIUMUnbounded memory growth with session handling in TLSv1.3EPSS 54.0%CVE-2023-3341HIGHA stack exhaustion flaw in control channel code may cause named to terminate unexpectedlyEPSS 2.6%CVE-2024-27804HIGHThe issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionEPSS 1.3%CVE-2021-43174—gzip transfer encoding caused out-of-memory crashEPSS 1.2%CVE-2026-34183HIGHUnbounded Memory Growth in the QUIC PATH_CHALLENGE HandlerEPSS 1.0%CVE-2025-2240HIGHSmallrye-fault-tolerance: smallrye fault toleranceEPSS 1.0%CVE-2023-28968MEDIUMJunos OS: SRX Series: Policies that rely on JDPI-Decoder actions may fail openEPSS 0.6%CVE-2023-52891MEDIUMA vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.5), SIMATIC Energy Manager PRO (All versions < V7.5),EPSS 0.5%CVE-2026-24819MEDIUMAn out-of-memory (OOM) issue in foxinmy/weixin4jEPSS 0.4%CVE-2026-54080MEDIUMveraPDF Parser DoS via PostScript CMap StreamsEPSS 0.3%CVE-2026-54081MEDIUMveraPDF Parser DoS via PostScript Type 1 Font ProgramsEPSS 0.3%CVE-2026-13056HIGHA user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAMEPSS 0.3%CVE-2024-27796HIGHThe issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey EPSS 0.3%CVE-2026-8199HIGHPost-auth memory exhaustion via bitwise match expressionsEPSS 0.3%CVE-2026-3201MEDIUMImproperly Controlled Sequential Memory Allocation in WiresharkEPSS 0.2%CVE-2025-13945MEDIUMImproperly Controlled Sequential Memory Allocation in WiresharkEPSS 0.2%CVE-2026-6533MEDIUMImproperly Controlled Sequential Memory Allocation in WiresharkEPSS 0.1%CVE-2026-6535MEDIUMImproperly Controlled Sequential Memory Allocation in WiresharkEPSS 0.1%CVE-2026-6869MEDIUMImproperly Controlled Sequential Memory Allocation in WiresharkEPSS 0.1%CVE-2026-6867MEDIUMImproperly Controlled Sequential Memory Allocation in WiresharkEPSS 0.1%