Weaknesses of type CWE-789

251 results

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória de forma proporcional a entrada do usuário sem validar limites, permitindo que um atacante force a alocação de quantidades excessivas de RAM. Isso causa consumo de memória em massa (DoS) ou até crash da aplicação.

Example

Um servidor web que redimensiona um buffer baseado no header Content-Length enviado pelo cliente sem checá-lo contra um máximo razoável. Um atacante envia Content-Length: 999999999, forçando a alocação de gigabytes de memória instantaneamente e derrubando o serviço.

How to mitigate

Defina e enforce limites máximos de memória por operação — valide tamanhos de entrada contra thresholds conhecidos antes de alocar. Use mecanismos do SO (ulimit, cgroups) para restringir memória por processo como última linha de defesa.

CVE-2025-54149MEDIUMQsync CentralEPSS 0.3%CVE-2025-54151MEDIUMQsync CentralEPSS 0.3%CVE-2025-54150MEDIUMQsync CentralEPSS 0.3%CVE-2023-52429MEDIUMdm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate more than INT_MAX byteEPSS 0.2%CVE-2026-89092MEDIUMStack overflow in nscd due to unbounded alloca useEPSS 0.2%CVE-2026-6340MEDIUMMemory Exhaustion via Malicious 7zip File UploadEPSS 0.2%CVE-2025-20140HIGHA vulnerability in the Wireless Network Control daemon (wncd) of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unEPSS 0.2%CVE-2023-20202MEDIUMA vulnerability in the Wireless Network Control daemon (wncd) of Cisco IOS XE Software for Wireless LAN Controllers could allow an unauthentEPSS 0.2%CVE-2026-12185HIGHBKS/UBER keystore allocates from untrusted lengths before integrity checkEPSS 0.2%CVE-2026-41312MEDIUMpypdf: Manipulated FlateDecode predictor parameters can exhaust RAMEPSS 0.2%CVE-2026-27887MEDIUMSpin has memory leaks in various WIT interfacesEPSS 0.2%CVE-2026-41314MEDIUMpypdf: Manipulated FlateDecode image dimensions can exhaust RAMEPSS 0.2%CVE-2026-26246MEDIUMMemory Exhaustion via Malformed PSD File UploadEPSS 0.2%CVE-2026-35186MEDIUMWasmtime has an improperly masked return value from `table.grow` with Winch compiler backendEPSS 0.2%CVE-2021-1568MEDIUMCisco AnyConnect Secure Mobility Client for Windows Denial of Service VulnerabilityEPSS 0.2%CVE-2026-83530MEDIUMUncontrolled Memory Allocation in cel-goEPSS 0.2%CVE-2026-44967MEDIUMopentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP responseEPSS 0.2%CVE-2026-22188MEDIUMPanda3D <= 1.10.16 Deploy-Stub Stack Exhaustion via Unbounded alloca()EPSS 0.2%CVE-2022-20717MEDIUMCisco SD-WAN vEdge Routers Denial of Service VulnerabilityEPSS 0.2%CVE-2025-4605MEDIUMUSD File Parsing Memory Allocation VulnerabilityEPSS 0.2%