Weaknesses of type CWE-789

336 results

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória de forma proporcional a entrada do usuário sem validar limites, permitindo que um atacante force a alocação de quantidades excessivas de RAM. Isso causa consumo de memória em massa (DoS) ou até crash da aplicação.

Example

Um servidor web que redimensiona um buffer baseado no header Content-Length enviado pelo cliente sem checá-lo contra um máximo razoável. Um atacante envia Content-Length: 999999999, forçando a alocação de gigabytes de memória instantaneamente e derrubando o serviço.

How to mitigate

Defina e enforce limites máximos de memória por operação — valide tamanhos de entrada contra thresholds conhecidos antes de alocar. Use mecanismos do SO (ulimit, cgroups) para restringir memória por processo como última linha de defesa.

CVE-2026-14454CRITICALImager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signedEPSS 0.7%CVE-2026-115825HIGHHTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-LengthEPSS 0.7%CVE-2026-93019CRITICALImager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_readEPSS 0.7%CVE-2026-82435CRITICALApache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging DecoderEPSS 0.7%CVE-2025-23331HIGHNVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where a user could cause a memory allocation with excessive siEPSS 0.6%CVE-2026-84857MEDIUMsigoden aichat API Endpoint serve.rs memory allocationEPSS 0.6%CVE-2026-88045HIGHrclone: S3 multipart declared-length memory exhaustionEPSS 0.6%CVE-2026-19566HIGHNet::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengthsEPSS 0.6%CVE-2026-54638HIGHtd has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.DecodeEPSS 0.6%CVE-2024-32035MEDIUMMemory Allocation with Excessive Size Value in SixLabors.ImageSharpEPSS 0.6%CVE-2026-22026HIGHCryptoLib Unbounded Memory Allocation in KMC HTTP Response Handler Allows Resource ExhaustionEPSS 0.6%CVE-2026-94626HIGHvLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_sizeEPSS 0.6%CVE-2025-25186MEDIUMNet::IMAP vulnerable to possible DoS by memory exhaustionEPSS 0.6%CVE-2026-33174MEDIUMRails Active Storage has a possible DoS vulnerability when in proxy mode via Range requestsEPSS 0.6%CVE-2026-58060HIGHHSS public-key level count unbounded, enabling huge allocation on verifyEPSS 0.6%CVE-2026-55079MEDIUMCoder's unbounded memory allocation in provisioner file upload allows authenticated denial of serviceEPSS 0.6%CVE-2026-44253MEDIUMWazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str allocation and div_msg_box accumulationEPSS 0.6%CVE-2026-85715HIGHExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory ExhaustionEPSS 0.6%CVE-2026-75935HIGHMemory-amplification denial of service via declared-length preallocation in Amazon ion-javaEPSS 0.6%CVE-2026-77322HIGHSIPGO: DoS via unvalidated WebSocket frame lengthEPSS 0.6%