Weaknesses of type CWE-789

336 results

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória de forma proporcional a entrada do usuário sem validar limites, permitindo que um atacante force a alocação de quantidades excessivas de RAM. Isso causa consumo de memória em massa (DoS) ou até crash da aplicação.

Example

Um servidor web que redimensiona um buffer baseado no header Content-Length enviado pelo cliente sem checá-lo contra um máximo razoável. Um atacante envia Content-Length: 999999999, forçando a alocação de gigabytes de memória instantaneamente e derrubando o serviço.

How to mitigate

Defina e enforce limites máximos de memória por operação — valide tamanhos de entrada contra thresholds conhecidos antes de alocar. Use mecanismos do SO (ulimit, cgroups) para restringir memória por processo como última linha de defesa.

CVE-2026-85715HIGHExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory ExhaustionEPSS 0.6%CVE-2026-77301HIGHadm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)EPSS 0.6%CVE-2026-42440HIGHApache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReaderEPSS 0.6%CVE-2026-21452HIGHMessagePack-Java Vulnerable to Remote Denial of Service via Malicious .msgpack Model File Triggering Unbounded EXT Payload AllocationEPSS 0.6%CVE-2026-56387HIGHApache bRPC: Remote Memory Exhaustion in RTMP AMF ParserEPSS 0.6%CVE-2024-20260HIGHCisco Adaptive Security Virtual Appliance and Secure Firewall Threat Defense Virtual SSL VPN Denial of Service VulnerabilityEPSS 0.6%CVE-2026-111108CRITICALApache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readersEPSS 0.6%CVE-2026-44630HIGHApache IoTDB: RPC service denial of service via unchecked Thrift string lengthEPSS 0.6%CVE-2026-15337MEDIUMPotential denial-of-service vulnerability in check_for_language()EPSS 0.6%CVE-2026-22803HIGHSvelteKit has a memory amplification DoS in Remote Functions binary form deserializerEPSS 0.6%CVE-2026-111279HIGHDragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBEREPSS 0.6%CVE-2026-40006HIGHApache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiverEPSS 0.6%CVE-2026-20295HIGHCisco Secure Firewall Management Center and Secure Firewall Threat Defense Software sftunnel Memory Exhaustion Denial of Service VulnerabilityEPSS 0.6%CVE-2026-59844MEDIUMLibssh: libssh: denial of service via oversized sftp read lengthEPSS 0.6%CVE-2024-35152MEDIUMIBM Db2 denial of serviceEPSS 0.6%CVE-2025-61600HIGHUnbounded Memory Allocation in Stalwart IMAP parserEPSS 0.6%CVE-2026-24030MEDIUMUnbounded memory allocation for DoQ and DoH3EPSS 0.6%CVE-2026-25985HIGHMemory allocation with excessive without limits in the internal SVG decoderEPSS 0.6%CVE-2024-37529MEDIUMIBM Db2 denial of serviceEPSS 0.5%CVE-2026-114349MEDIUMApache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batchesEPSS 0.5%