Weaknesses of type CWE-789

251 results

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória de forma proporcional a entrada do usuário sem validar limites, permitindo que um atacante force a alocação de quantidades excessivas de RAM. Isso causa consumo de memória em massa (DoS) ou até crash da aplicação.

Example

Um servidor web que redimensiona um buffer baseado no header Content-Length enviado pelo cliente sem checá-lo contra um máximo razoável. Um atacante envia Content-Length: 999999999, forçando a alocação de gigabytes de memória instantaneamente e derrubando o serviço.

How to mitigate

Defina e enforce limites máximos de memória por operação — valide tamanhos de entrada contra thresholds conhecidos antes de alocar. Use mecanismos do SO (ulimit, cgroups) para restringir memória por processo como última linha de defesa.

CVE-2026-40891MEDIUMOpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handlingEPSS 0.2%CVE-2026-39882MEDIUMOpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodiesEPSS 0.2%CVE-2026-47734MEDIUMDulwich has unbounded memory allocation in receive-pack from crafted thin packsEPSS 0.2%CVE-2024-40680MEDIUMIBM MQ denial of serviceEPSS 0.2%CVE-2026-53428MEDIUMUnbounded memory allocation in highlight_lines range expansion in mdexEPSS 0.2%CVE-2026-32836MEDIUMmackron / dr_libs dr_flac.h Excessive Memory Allocation in PICTURE Metadata ParsingEPSS 0.2%CVE-2026-26931MEDIUMMemory Allocation with Excessive Size Value in Metricbeat Leading to Denial of ServiceEPSS 0.2%CVE-2022-20845MEDIUMCisco Network Convergence System 4000 Series TL1 Denial of Service VulnerabilityEPSS 0.2%CVE-2026-29776LOWFreeRDP has an Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core LibraryEPSS 0.2%CVE-2026-2456MEDIUMDenial of Service via Unbounded Memory Allocation in Integration ActionsEPSS 0.2%CVE-2026-55782LOWNanaZip: Unbounded memory allocation (DoS) in NanaZip WebAssembly parser via attacker-controlled section/name length fieldsEPSS 0.2%CVE-2026-14683MEDIUMHdrHistogram AbstractHistogram.java memory allocationEPSS 0.2%CVE-2026-14684MEDIUMHdrHistogram AbstractHistogram.java memory allocationEPSS 0.2%CVE-2026-55781LOWNanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fieldsEPSS 0.2%CVE-2026-52759MEDIUMGhidra < 12.1.1 - Denial of Service via Uncontrolled Memory Allocation in Mach-O ParserEPSS 0.2%CVE-2026-52753MEDIUMGhidra < 12.0.3 - Out-of-Memory in Rust Symbol Demangler via Malformed SymbolEPSS 0.2%CVE-2018-25378MEDIUMNotebook Pro 2.0 Denial of Service via Notebook Name FieldEPSS 0.1%CVE-2026-66485MEDIUMUncontrolled Memory Allocation in GNU cpioEPSS 0.1%CVE-2018-25295MEDIUMObserverIP Scan Tool 1.4.0.1 Denial of Service via IP FieldEPSS 0.1%CVE-2018-25279MEDIUMjiNa OCR Image to Text 1.0 Denial of Service via PNGEPSS 0.1%