Weaknesses of type CWE-789

338 results

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória de forma proporcional a entrada do usuário sem validar limites, permitindo que um atacante force a alocação de quantidades excessivas de RAM. Isso causa consumo de memória em massa (DoS) ou até crash da aplicação.

Example

Um servidor web que redimensiona um buffer baseado no header Content-Length enviado pelo cliente sem checá-lo contra um máximo razoável. Um atacante envia Content-Length: 999999999, forçando a alocação de gigabytes de memória instantaneamente e derrubando o serviço.

How to mitigate

Defina e enforce limites máximos de memória por operação — valide tamanhos de entrada contra thresholds conhecidos antes de alocar. Use mecanismos do SO (ulimit, cgroups) para restringir memória por processo como última linha de defesa.

CVE-2026-26246MEDIUMMemory Exhaustion via Malformed PSD File UploadEPSS 0.2%CVE-2026-41312MEDIUMpypdf: Manipulated FlateDecode predictor parameters can exhaust RAMEPSS 0.2%CVE-2026-41314MEDIUMpypdf: Manipulated FlateDecode image dimensions can exhaust RAMEPSS 0.2%CVE-2026-35186MEDIUMWasmtime has an improperly masked return value from `table.grow` with Winch compiler backendEPSS 0.2%CVE-2026-103582—Apache ActiveMQ NMS OpenWire Client Library: Unbounded/Unvalidated Length Fields in Apache.NMS.OpenWire Unmarshalling (DoS)EPSS 0.2%CVE-2026-107389MEDIUMmusic-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abortEPSS 0.2%CVE-2021-1568MEDIUMCisco AnyConnect Secure Mobility Client for Windows Denial of Service VulnerabilityEPSS 0.2%CVE-2026-22188MEDIUMPanda3D <= 1.10.16 Deploy-Stub Stack Exhaustion via Unbounded alloca()EPSS 0.2%CVE-2025-4605MEDIUMUSD File Parsing Memory Allocation VulnerabilityEPSS 0.2%CVE-2026-112214MEDIUMGstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parserEPSS 0.2%CVE-2026-44967MEDIUMopentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP responseEPSS 0.2%CVE-2026-78861HIGHAn issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private KeyEPSS 0.2%CVE-2022-20717MEDIUMCisco SD-WAN vEdge Routers Denial of Service VulnerabilityEPSS 0.2%CVE-2026-39882MEDIUMOpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodiesEPSS 0.2%CVE-2026-32836MEDIUMmackron / dr_libs dr_flac.h Excessive Memory Allocation in PICTURE Metadata ParsingEPSS 0.2%CVE-2026-107387MEDIUMmusic-metadata: Uncontrolled memory allocation in APEv2 parserEPSS 0.2%CVE-2026-107388MEDIUMmusic-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoSEPSS 0.2%CVE-2026-40891MEDIUMOpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handlingEPSS 0.2%CVE-2026-102820MEDIUMpageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)EPSS 0.2%CVE-2026-47734MEDIUMDulwich has unbounded memory allocation in receive-pack from crafted thin packsEPSS 0.2%