Weaknesses of type CWE-789

338 results

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória de forma proporcional a entrada do usuário sem validar limites, permitindo que um atacante force a alocação de quantidades excessivas de RAM. Isso causa consumo de memória em massa (DoS) ou até crash da aplicação.

Example

Um servidor web que redimensiona um buffer baseado no header Content-Length enviado pelo cliente sem checá-lo contra um máximo razoável. Um atacante envia Content-Length: 999999999, forçando a alocação de gigabytes de memória instantaneamente e derrubando o serviço.

How to mitigate

Defina e enforce limites máximos de memória por operação — valide tamanhos de entrada contra thresholds conhecidos antes de alocar. Use mecanismos do SO (ulimit, cgroups) para restringir memória por processo como última linha de defesa.

CVE-2024-40680MEDIUMIBM MQ denial of serviceEPSS 0.2%CVE-2026-66485MEDIUMUncontrolled Memory Allocation in GNU cpioEPSS 0.2%CVE-2026-53428MEDIUMUnbounded memory allocation in highlight_lines range expansion in mdexEPSS 0.2%CVE-2026-29776LOWFreeRDP has an Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core LibraryEPSS 0.2%CVE-2026-105613MEDIUMPostgreSQL Anonymizer: Unbounded memory allocation (DoS) in range-based dummy functionsEPSS 0.2%CVE-2026-105614MEDIUMPostgreSQL Anonymizer: Unbounded image-decode memory allocation (DoS) in anon.image_blur()EPSS 0.2%CVE-2026-26931MEDIUMMemory Allocation with Excessive Size Value in Metricbeat Leading to Denial of ServiceEPSS 0.2%CVE-2026-112283MEDIUMlibbluray through 1.5.1 Uncontrolled Memory Allocation via _parse_extent_start_pointsEPSS 0.2%CVE-2026-42146MEDIUMCImg Library: Uncontrolled memory allocation via nb_colors field in _load_bmpEPSS 0.2%CVE-2026-112048MEDIUMlibspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring CountEPSS 0.2%CVE-2026-55782LOWNanaZip: Unbounded memory allocation (DoS) in NanaZip WebAssembly parser via attacker-controlled section/name length fieldsEPSS 0.2%CVE-2022-20845MEDIUMCisco Network Convergence System 4000 Series TL1 Denial of Service VulnerabilityEPSS 0.2%CVE-2026-2456MEDIUMDenial of Service via Unbounded Memory Allocation in Integration ActionsEPSS 0.2%CVE-2026-110258MEDIUMOW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Multiple RET InstructionsEPSS 0.2%CVE-2026-110257MEDIUMOW2 ASM 5.0 before 9.11 Excessive Memory Allocation via BootstrapMethods AttributeEPSS 0.2%CVE-2026-86776MEDIUMKeePass 2.35 through 2.61.1 Memory Exhaustion via KDBX Header Field SizeEPSS 0.2%CVE-2026-62254MEDIUMLibreDWG: excessive class-decoding reallocation in R13-R2000 DWG parsingEPSS 0.2%CVE-2026-115394MEDIUMGhidra through 12.2 Denial of Service via BinaryField Memory AllocationEPSS 0.2%CVE-2026-113604MEDIUMGhidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header CountsEPSS 0.2%CVE-2026-83530MEDIUMUncontrolled Memory Allocation in cel-goEPSS 0.2%