Weaknesses of type CWE-789

338 results

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória de forma proporcional a entrada do usuário sem validar limites, permitindo que um atacante force a alocação de quantidades excessivas de RAM. Isso causa consumo de memória em massa (DoS) ou até crash da aplicação.

Example

Um servidor web que redimensiona um buffer baseado no header Content-Length enviado pelo cliente sem checá-lo contra um máximo razoável. Um atacante envia Content-Length: 999999999, forçando a alocação de gigabytes de memória instantaneamente e derrubando o serviço.

How to mitigate

Defina e enforce limites máximos de memória por operação — valide tamanhos de entrada contra thresholds conhecidos antes de alocar. Use mecanismos do SO (ulimit, cgroups) para restringir memória por processo como última linha de defesa.

CVE-2026-14684MEDIUMHdrHistogram AbstractHistogram.java memory allocationEPSS 0.2%CVE-2026-14683MEDIUMHdrHistogram AbstractHistogram.java memory allocationEPSS 0.2%CVE-2026-55781LOWNanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fieldsEPSS 0.2%CVE-2026-85201MEDIUMIn Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf mEPSS 0.2%CVE-2026-17535MEDIUMVelociraptor Multiple Crashes in NTFS Parser when applied to invalid NTFS VolumesEPSS 0.2%CVE-2026-52753MEDIUMGhidra < 12.0.3 - Out-of-Memory in Rust Symbol Demangler via Malformed SymbolEPSS 0.2%CVE-2026-52759MEDIUMGhidra < 12.1.1 - Denial of Service via Uncontrolled Memory Allocation in Mach-O ParserEPSS 0.2%CVE-2026-97853MEDIUMUnbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoSEPSS 0.1%CVE-2018-25378MEDIUMNotebook Pro 2.0 Denial of Service via Notebook Name FieldEPSS 0.1%CVE-2026-115922MEDIUMONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIsEPSS 0.1%CVE-2026-54697MEDIUMConnectBot SSH: Excessive allocation and integer overflow in DER private-key parsingEPSS 0.1%CVE-2018-25295MEDIUMObserverIP Scan Tool 1.4.0.1 Denial of Service via IP FieldEPSS 0.1%CVE-2018-25279MEDIUMjiNa OCR Image to Text 1.0 Denial of Service via PNGEPSS 0.1%CVE-2018-25274MEDIUMInfraRecorder 0.53 Denial of Service via txt File ImportEPSS 0.1%CVE-2026-93323MEDIUMOversized Dockerfile or .dockerignore can exhaust buildkitd memoryEPSS 0.1%CVE-2026-47319MEDIUMMemory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows Excessive Allocation. This issue affects rlEPSS 0.1%CVE-2026-123563HIGHDevalue before 5.9.3 Typed-Array Allocation Validation Bypass via parseEPSS —CVE-2026-123616HIGHimgproxy 3.3.0 before 4.0.16 Memory Exhaustion DoS via ICO LoaderEPSS —