Weaknesses of type CWE-789

338 results

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória de forma proporcional a entrada do usuário sem validar limites, permitindo que um atacante force a alocação de quantidades excessivas de RAM. Isso causa consumo de memória em massa (DoS) ou até crash da aplicação.

Example

Um servidor web que redimensiona um buffer baseado no header Content-Length enviado pelo cliente sem checá-lo contra um máximo razoável. Um atacante envia Content-Length: 999999999, forçando a alocação de gigabytes de memória instantaneamente e derrubando o serviço.

How to mitigate

Defina e enforce limites máximos de memória por operação — valide tamanhos de entrada contra thresholds conhecidos antes de alocar. Use mecanismos do SO (ulimit, cgroups) para restringir memória por processo como última linha de defesa.

CVE-2021-47972HIGHSticky Notes & Color Widgets 1.4.2 Denial of ServiceEPSS 0.3%CVE-2021-47973HIGHSticky Notes Widget 3.0.6 Denial of Service via Buffer OverflowEPSS 0.3%CVE-2021-47970HIGHMacaron Notes 5.5 Denial of Service via Buffer OverflowEPSS 0.3%CVE-2026-102466HIGHIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-clientEPSS 0.3%CVE-2026-94633HIGHApache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name lengthEPSS 0.3%CVE-2026-42241MEDIUMParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type WidthEPSS 0.3%CVE-2025-54151MEDIUMQsync CentralEPSS 0.3%CVE-2025-54149MEDIUMQsync CentralEPSS 0.3%CVE-2025-54150MEDIUMQsync CentralEPSS 0.3%CVE-2023-20202MEDIUMA vulnerability in the Wireless Network Control daemon (wncd) of Cisco IOS XE Software for Wireless LAN Controllers could allow an unauthentEPSS 0.3%CVE-2026-35549MEDIUMAn issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_pEPSS 0.3%CVE-2026-47313MEDIUMMemory allocation with excessive size value vulnerability in Samsung Open Source Escargot allows Excessive Allocation. This issue affects EEPSS 0.3%CVE-2026-27887MEDIUMSpin has memory leaks in various WIT interfacesEPSS 0.3%CVE-2021-34854HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker EPSS 0.3%CVE-2026-58559MEDIUMDoS vulnerability in the vibration service. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.3%CVE-2025-20140HIGHA vulnerability in the Wireless Network Control daemon (wncd) of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unEPSS 0.2%CVE-2023-52429MEDIUMdm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate more than INT_MAX byteEPSS 0.2%CVE-2026-89092MEDIUMStack overflow in nscd due to unbounded alloca useEPSS 0.2%CVE-2026-6340MEDIUMMemory Exhaustion via Malicious 7zip File UploadEPSS 0.2%CVE-2026-107215HIGHExcelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoSEPSS 0.2%