Weaknesses of type CWE-789

251 results

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória de forma proporcional a entrada do usuário sem validar limites, permitindo que um atacante force a alocação de quantidades excessivas de RAM. Isso causa consumo de memória em massa (DoS) ou até crash da aplicação.

Example

Um servidor web que redimensiona um buffer baseado no header Content-Length enviado pelo cliente sem checá-lo contra um máximo razoável. Um atacante envia Content-Length: 999999999, forçando a alocação de gigabytes de memória instantaneamente e derrubando o serviço.

How to mitigate

Defina e enforce limites máximos de memória por operação — valide tamanhos de entrada contra thresholds conhecidos antes de alocar. Use mecanismos do SO (ulimit, cgroups) para restringir memória por processo como última linha de defesa.

CVE-2026-85442HIGHMOOS core-moos through 10.4.0 MOOSDB Denial of Service via Unbounded Packet AllocationEPSS 0.4%CVE-2026-77301HIGHadm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)EPSS 0.4%CVE-2026-77410HIGHRabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer AllocationEPSS 0.4%CVE-2026-85715HIGHExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory ExhaustionEPSS 0.4%CVE-2026-54059HIGHPillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loadingEPSS 0.4%CVE-2026-27809MEDIUMpsd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gapsEPSS 0.4%CVE-2026-24158HIGHNVIDIA Triton Inference Server contains a vulnerability in the HTTP endpoint where an attacker may cause a denial of service by providing a EPSS 0.4%CVE-2026-71314HIGHNuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island renderingEPSS 0.4%CVE-2026-55149HIGHVouch Proxy: Unbounded Multipart Cookie Allocation DoSEPSS 0.4%CVE-2026-25899HIGHFiber is Vulnerable to Denial of Service via Flash Cookie Unbounded AllocationEPSS 0.4%CVE-2026-59204HIGHPillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of serviceEPSS 0.4%CVE-2024-41762MEDIUMIBM Db2 denial of serviceEPSS 0.4%CVE-2026-58067HIGHA vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service.EPSS 0.4%CVE-2018-25368HIGHNord VPN 6.14.31 Denial of Service via Password FieldEPSS 0.4%CVE-2026-71218MEDIUMIperf3: unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustionEPSS 0.4%CVE-2025-62599HIGHeprosima Fast DDS affected by Out-of-Memory in readPropertySeq via Manipulated DATA Submessage when DDS Security is enabledEPSS 0.4%CVE-2024-37071MEDIUMIBM Db2 denial of serviceEPSS 0.4%CVE-2025-11579MEDIUMDoS via Out Of Memory CrashEPSS 0.4%CVE-2025-54801HIGHFiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in DecoderEPSS 0.4%CVE-2026-84857MEDIUMsigoden aichat API Endpoint serve.rs memory allocationEPSS 0.4%