Weaknesses of type CWE-789

336 results

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória de forma proporcional a entrada do usuário sem validar limites, permitindo que um atacante force a alocação de quantidades excessivas de RAM. Isso causa consumo de memória em massa (DoS) ou até crash da aplicação.

Example

Um servidor web que redimensiona um buffer baseado no header Content-Length enviado pelo cliente sem checá-lo contra um máximo razoável. Um atacante envia Content-Length: 999999999, forçando a alocação de gigabytes de memória instantaneamente e derrubando o serviço.

How to mitigate

Defina e enforce limites máximos de memória por operação — valide tamanhos de entrada contra thresholds conhecidos antes de alocar. Use mecanismos do SO (ulimit, cgroups) para restringir memória por processo como última linha de defesa.

CVE-2026-69702HIGHSnailJob 1.7.0 Denial of Service via FuryUtil.deserialize OOMEPSS 0.5%CVE-2026-24146HIGHNVIDIA Triton Inference Server contains a vulnerability where insufficient input validation and a large number of outputs could cause a servEPSS 0.5%CVE-2020-37280HIGHcbor-sync through 1.0.4 Memory Exhaustion via Unchecked CBOR Array LengthsEPSS 0.5%CVE-2026-93307MEDIUMO-RAN-SC SMO OAM VES Collector memory allocationEPSS 0.5%CVE-2026-112399HIGHPillow: APNG background disposal allocates full canvas before decompression bomb checkEPSS 0.5%CVE-2026-11946HIGHGetEndpoints Memory Exhaustion in open62541EPSS 0.5%CVE-2026-77410HIGHRabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer AllocationEPSS 0.5%CVE-2026-77619HIGHVector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation.EPSS 0.5%CVE-2026-33592HIGHFindServers Memory Exhaustion in open62541EPSS 0.5%CVE-2026-77354HIGHkin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decodingEPSS 0.5%CVE-2026-109149MEDIUMbeautifier js-beautify memory allocationEPSS 0.5%CVE-2026-55379HIGHPillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loadingEPSS 0.5%CVE-2026-103603HIGHUnbounded HSS public key level count allows huge array allocation during signature verificationEPSS 0.5%CVE-2026-116095MEDIUMsmg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocationEPSS 0.5%CVE-2026-55380HIGHPillow GdImageFile decompression bomb protection bypassEPSS 0.5%CVE-2025-62600HIGHeprosima Fast DDS affected by Out-of-Memory in readBinaryPropertySeq via Manipulated DATA Submessage when DDS Security is enabledEPSS 0.5%CVE-2026-9538HIGHArchive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar headerEPSS 0.5%CVE-2026-47667HIGHCImg Library: Uncontrolled Memory Allocation and Memory Leak in `_load_analyze()` via Crafted NIfTI/Analyze HeaderEPSS 0.5%CVE-2026-59991HIGHpsd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometryEPSS 0.5%CVE-2026-59938MEDIUMpypdf: Possible large memory usage for wrong image dimensionsEPSS 0.5%