Weaknesses of type CWE-789

251 results

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória de forma proporcional a entrada do usuário sem validar limites, permitindo que um atacante force a alocação de quantidades excessivas de RAM. Isso causa consumo de memória em massa (DoS) ou até crash da aplicação.

Example

Um servidor web que redimensiona um buffer baseado no header Content-Length enviado pelo cliente sem checá-lo contra um máximo razoável. Um atacante envia Content-Length: 999999999, forçando a alocação de gigabytes de memória instantaneamente e derrubando o serviço.

How to mitigate

Defina e enforce limites máximos de memória por operação — valide tamanhos de entrada contra thresholds conhecidos antes de alocar. Use mecanismos do SO (ulimit, cgroups) para restringir memória por processo como última linha de defesa.

CVE-2026-55213HIGHh2o: musl libc stack overflow (QPACK)EPSS 0.5%CVE-2026-44453HIGHh2o is vulnerable to musl libc stack overflowEPSS 0.5%CVE-2023-5371MEDIUMMemory Allocation with Excessive Size Value in WiresharkEPSS 0.5%CVE-2026-42189HIGHRussh: Pre-auth DoS via unbounded allocation in keyboard-interactive authEPSS 0.5%CVE-2023-33953HIGHDenial-of-Service in gRPCEPSS 0.5%CVE-2025-3632HIGHIBM 4769 Developers Toolkit denial of serviceEPSS 0.5%CVE-2026-25579CRITICALNavidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpointsEPSS 0.5%CVE-2025-43857MEDIUMnet-imap rubygem vulnerable to possible DoS by memory exhaustionEPSS 0.5%CVE-2026-67211HIGHApache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializerEPSS 0.5%CVE-2026-15567HIGHWildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listenerEPSS 0.5%CVE-2026-15053HIGHTanium addressed a denial of service vulnerability in Tanium Server.EPSS 0.5%CVE-2026-40894MEDIUMOpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headersEPSS 0.5%CVE-2025-30211HIGHKEX init error results with excessive memory usageEPSS 0.5%CVE-2026-40303HIGHzrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsingEPSS 0.5%CVE-2026-39312HIGHPre-Auth EAP-TLS DoS on SoftEther VPN Developer EditionEPSS 0.4%CVE-2025-32386MEDIUMHelm Allows A Specially Crafted Chart Archive To Cause Out Of Memory TerminationEPSS 0.4%CVE-2026-9538HIGHArchive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar headerEPSS 0.4%CVE-2026-94626HIGHvLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_sizeEPSS 0.4%CVE-2026-54448MEDIUMTrivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parserEPSS 0.4%CVE-2026-75935HIGHMemory-amplification denial of service via declared-length preallocation in Amazon ion-javaEPSS 0.4%