Weaknesses of type CWE-789

338 results

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória de forma proporcional a entrada do usuário sem validar limites, permitindo que um atacante force a alocação de quantidades excessivas de RAM. Isso causa consumo de memória em massa (DoS) ou até crash da aplicação.

Example

Um servidor web que redimensiona um buffer baseado no header Content-Length enviado pelo cliente sem checá-lo contra um máximo razoável. Um atacante envia Content-Length: 999999999, forçando a alocação de gigabytes de memória instantaneamente e derrubando o serviço.

How to mitigate

Defina e enforce limites máximos de memória por operação — valide tamanhos de entrada contra thresholds conhecidos antes de alocar. Use mecanismos do SO (ulimit, cgroups) para restringir memória por processo como última linha de defesa.

CVE-2022-30522—mod_sed denial of serviceEPSS 89.9%CVE-2026-49975HIGHApache HTTP Server: mod_http2 denial of serviceEPSS 33.0%CVE-2025-27533MEDIUMApache ActiveMQ: Unchecked buffer length can cause excessive memory allocationEPSS 9.1%CVE-2017-7651—In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of connections with large EPSS 5.1%CVE-2021-31811—A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny fileEPSS 3.6%CVE-2021-27906—A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the fileEPSS 3.3%CVE-2024-43484HIGH.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityEPSS 3.0%CVE-2020-8552MEDIUMKubernetes API server denial of serviceEPSS 2.8%CVE-2023-3223HIGHUndertow: outofmemoryerror due to @multipartconfig handlingEPSS 2.7%CVE-2018-12541—In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the hEPSS 2.7%CVE-2020-24685HIGHAC500 V2 unauthenticated crafter packet vulnerabilityEPSS 1.6%CVE-2017-7652—In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers EPSS 1.6%CVE-2026-66733HIGHSonic 3 A.I.R. Unbounded Memory Allocation DoS via ReceivedPacketCacheEPSS 1.6%CVE-2022-22188HIGHJunos OS: QFX5100/QFX5110/QFX5120/QFX5200/QFX5210/EX4600/EX4650 Series: When storm control profiling is enabled and a device is under an active storm, a Heap-based Buffer Overflow in the PFE will cause a device to hang.EPSS 1.5%CVE-2022-34917HIGHUnauthenticated clients may cause OutOfMemoryError on Apache Kafka BrokersEPSS 1.5%CVE-2017-20016MEDIUMWEKA INTEREST Security Scanner Portscan memory allocationEPSS 1.5%CVE-2020-5303LOWDenial of service in TendermintEPSS 1.4%CVE-2020-8551MEDIUMKubernetes kubelet denial of serviceEPSS 1.2%CVE-2020-3596MEDIUMCisco Expressway Series and TelePresence Video Communication Server Denial of Service VulnerabilityEPSS 1.2%CVE-2022-36078HIGHSlice Memory Allocation with Excessive Size Value in binaryEPSS 1.2%