Weaknesses of type CWE-789

251 results

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória de forma proporcional a entrada do usuário sem validar limites, permitindo que um atacante force a alocação de quantidades excessivas de RAM. Isso causa consumo de memória em massa (DoS) ou até crash da aplicação.

Example

Um servidor web que redimensiona um buffer baseado no header Content-Length enviado pelo cliente sem checá-lo contra um máximo razoável. Um atacante envia Content-Length: 999999999, forçando a alocação de gigabytes de memória instantaneamente e derrubando o serviço.

How to mitigate

Defina e enforce limites máximos de memória por operação — valide tamanhos de entrada contra thresholds conhecidos antes de alocar. Use mecanismos do SO (ulimit, cgroups) para restringir memória por processo como última linha de defesa.

CVE-2025-23331HIGHNVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where a user could cause a memory allocation with excessive siEPSS 0.6%CVE-2026-40006HIGHApache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiverEPSS 0.6%CVE-2026-59844MEDIUMLibssh: libssh: denial of service via oversized sftp read lengthEPSS 0.6%CVE-2024-35152MEDIUMIBM Db2 denial of serviceEPSS 0.6%CVE-2025-61600HIGHUnbounded Memory Allocation in Stalwart IMAP parserEPSS 0.6%CVE-2024-37529MEDIUMIBM Db2 denial of serviceEPSS 0.5%CVE-2026-20295HIGHCisco Secure Firewall Management Center and Secure Firewall Threat Defense Software sftunnel Memory Exhaustion Denial of Service VulnerabilityEPSS 0.5%CVE-2023-43632CRITICALFreely Allocate Buffer on The Stack With Data From SocketEPSS 0.5%CVE-2026-24030MEDIUMUnbounded memory allocation for DoQ and DoH3EPSS 0.5%CVE-2026-88045HIGHrclone: S3 multipart declared-length memory exhaustionEPSS 0.5%CVE-2026-24146HIGHNVIDIA Triton Inference Server contains a vulnerability where insufficient input validation and a large number of outputs could cause a servEPSS 0.5%CVE-2026-33592HIGHFindServers Memory Exhaustion in open62541EPSS 0.5%CVE-2026-11946HIGHGetEndpoints Memory Exhaustion in open62541EPSS 0.5%CVE-2026-59938MEDIUMpypdf: Possible large memory usage for wrong image dimensionsEPSS 0.5%CVE-2026-44253MEDIUMWazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str allocation and div_msg_box accumulationEPSS 0.5%CVE-2026-25985HIGHMemory allocation with excessive without limits in the internal SVG decoderEPSS 0.5%CVE-2025-26618HIGHSSH SFTP packet size not verified properly in Erlang OTPEPSS 0.5%CVE-2026-67589HIGHApache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authenticationEPSS 0.5%CVE-2026-67551HIGHApache Qpid Proton Dotnet: Type size/count handling can lead to excessive allocation pre-authenticationEPSS 0.5%CVE-2026-55213HIGHh2o: musl libc stack overflow (QPACK)EPSS 0.5%