Weaknesses of type CWE-789

251 results

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória de forma proporcional a entrada do usuário sem validar limites, permitindo que um atacante force a alocação de quantidades excessivas de RAM. Isso causa consumo de memória em massa (DoS) ou até crash da aplicação.

Example

Um servidor web que redimensiona um buffer baseado no header Content-Length enviado pelo cliente sem checá-lo contra um máximo razoável. Um atacante envia Content-Length: 999999999, forçando a alocação de gigabytes de memória instantaneamente e derrubando o serviço.

How to mitigate

Defina e enforce limites máximos de memória por operação — valide tamanhos de entrada contra thresholds conhecidos antes de alocar. Use mecanismos do SO (ulimit, cgroups) para restringir memória por processo como última linha de defesa.

CVE-2025-2668MEDIUMIBM Db2 Denial of ServiceEPSS 0.4%CVE-2024-2494MEDIUMLibvirt: negative g_new0 length can lead to unbounded memory allocationEPSS 0.4%CVE-2026-35633MEDIUMOpenClaw < 2026.3.22 - Unbounded Memory Allocation via Remote Media Error ResponsesEPSS 0.4%CVE-2026-70377HIGHimagecli - Uncontrolled Memory Allocation via Unbounded scale Ratio Causes Denial of ServiceEPSS 0.4%CVE-2025-53893HIGHFile Browser Vulnerable to Uncontrolled Memory Consumption Due to Oversized File ProcessingEPSS 0.4%CVE-2025-61910HIGHNASA ION-DTN BPv7 4.1.3s Uncontrolled Memory Allocation that leads to Denial-of-ServiceEPSS 0.4%CVE-2026-59646HIGHDTLS handshake reassembler allocates buffer from unchecked 24-bit lengthEPSS 0.4%CVE-2026-55768HIGHGoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of serviceEPSS 0.4%CVE-2026-44375HIGHNerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowExceptionEPSS 0.4%CVE-2026-85445HIGHMOOS-IvP through 24.8.1 BHV_IPF Demultiplexer Memory Exhaustion via Packet CountEPSS 0.4%CVE-2026-8485MEDIUMUncontrolled Memory Allocation vulnerability in Progress Software MOVEit AutomationEPSS 0.3%CVE-2026-10142HIGHkafka-python prior to 2.3.2 Denial of Service via Protocol Parser Frame LengthEPSS 0.3%CVE-2026-19566HIGHNet::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengthsEPSS 0.3%CVE-2026-54638HIGHtd has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.DecodeEPSS 0.3%CVE-2026-27204MEDIUMWasmtime WASI implementations are vulnerable to guest-controlled resource exhaustionEPSS 0.3%CVE-2026-81693HIGHopenssl_encrypt before 1.4.9 Denial of Service via QR total fieldEPSS 0.3%CVE-2026-81692HIGHopenssl_encrypt before 1.4.9 Denial of Service via STREAMINFOEPSS 0.3%CVE-2026-5740HIGHUnauthenticated WebSocket binary frame causes denial of service in Mattermost ServerEPSS 0.3%CVE-2026-41178MEDIUMOpenTelemetry-Go's baggage parsing no longer caps raw header lengthEPSS 0.3%CVE-2025-29491MEDIUMAn allocation-size-too-big error in the parseSWF_DEFINEBINARYDATA function of libming v0.48 allows attackers to cause a Denial of Service (DEPSS 0.3%