Weaknesses of type CWE-789

251 results

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória de forma proporcional a entrada do usuário sem validar limites, permitindo que um atacante force a alocação de quantidades excessivas de RAM. Isso causa consumo de memória em massa (DoS) ou até crash da aplicação.

Example

Um servidor web que redimensiona um buffer baseado no header Content-Length enviado pelo cliente sem checá-lo contra um máximo razoável. Um atacante envia Content-Length: 999999999, forçando a alocação de gigabytes de memória instantaneamente e derrubando o serviço.

How to mitigate

Defina e enforce limites máximos de memória por operação — valide tamanhos de entrada contra thresholds conhecidos antes de alocar. Use mecanismos do SO (ulimit, cgroups) para restringir memória por processo como última linha de defesa.

CVE-2026-53717MEDIUMEnvoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar headerEPSS 0.7%CVE-2023-0809MEDIUMIn Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packets.EPSS 0.7%CVE-2026-43868MEDIUMApache Thrift: Rust implementation vulnerable to CVE-2020-13949 patternEPSS 0.7%CVE-2024-35116MEDIUMIBM MQ denial of serviceEPSS 0.7%CVE-2023-30837HIGHVyper storage allocator overflowEPSS 0.7%CVE-2026-53716MEDIUMEnvoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limitEPSS 0.7%CVE-2024-37168MEDIUM@grpc/grpc-js can allocate memory for incoming messages well above configured limitsEPSS 0.7%CVE-2026-14454CRITICALImager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signedEPSS 0.7%CVE-2026-58060HIGHHSS public-key level count unbounded, enabling huge allocation on verifyEPSS 0.7%CVE-2025-25186MEDIUMNet::IMAP vulnerable to possible DoS by memory exhaustionEPSS 0.6%CVE-2024-32035MEDIUMMemory Allocation with Excessive Size Value in SixLabors.ImageSharpEPSS 0.6%CVE-2026-22026HIGHCryptoLib Unbounded Memory Allocation in KMC HTTP Response Handler Allows Resource ExhaustionEPSS 0.6%CVE-2026-21452HIGHMessagePack-Java Vulnerable to Remote Denial of Service via Malicious .msgpack Model File Triggering Unbounded EXT Payload AllocationEPSS 0.6%CVE-2026-55079MEDIUMCoder's unbounded memory allocation in provisioner file upload allows authenticated denial of serviceEPSS 0.6%CVE-2026-33174MEDIUMRails Active Storage has a possible DoS vulnerability when in proxy mode via Range requestsEPSS 0.6%CVE-2026-82435CRITICALApache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging DecoderEPSS 0.6%CVE-2026-93019CRITICALImager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_readEPSS 0.6%CVE-2026-42440HIGHApache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReaderEPSS 0.6%CVE-2026-22803HIGHSvelteKit has a memory amplification DoS in Remote Functions binary form deserializerEPSS 0.6%CVE-2024-20260HIGHCisco Adaptive Security Virtual Appliance and Secure Firewall Threat Defense Virtual SSL VPN Denial of Service VulnerabilityEPSS 0.6%