Weaknesses of type CWE-789

251 results

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória de forma proporcional a entrada do usuário sem validar limites, permitindo que um atacante force a alocação de quantidades excessivas de RAM. Isso causa consumo de memória em massa (DoS) ou até crash da aplicação.

Example

Um servidor web que redimensiona um buffer baseado no header Content-Length enviado pelo cliente sem checá-lo contra um máximo razoável. Um atacante envia Content-Length: 999999999, forçando a alocação de gigabytes de memória instantaneamente e derrubando o serviço.

How to mitigate

Defina e enforce limites máximos de memória por operação — valide tamanhos de entrada contra thresholds conhecidos antes de alocar. Use mecanismos do SO (ulimit, cgroups) para restringir memória por processo como última linha de defesa.

CVE-2025-2518MEDIUMIBM Db2 denial of serviceEPSS 0.3%CVE-2026-72678MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceEPSS 0.3%CVE-2026-33524HIGHZserio: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in DeserializationEPSS 0.3%CVE-2022-22226MEDIUMJunos OS: EX4300-MP, EX4600, QFX5000 Series: In VxLAN scenarios specific packets processed cause a memory leak leading to a PFE crashEPSS 0.3%CVE-2026-42348MEDIUMOpAMP client reads unbounded HTTP response bodiesEPSS 0.3%CVE-2026-59649HIGHOpenPGP user-attribute subpacket length bounded only by JVM max memoryEPSS 0.3%CVE-2026-14682HIGHPossible OOM from unbounded up-front allocation on a definite-length readEPSS 0.3%CVE-2026-12852HIGHMLS wire decoder allocates attacker-declared opaque length before bounds checkEPSS 0.3%CVE-2026-47321HIGHApache MINA: Unbounded Decompression Amplification DoS in Zlib.inflateEPSS 0.3%CVE-2026-28253HIGHMemory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer ConciergeEPSS 0.3%CVE-2026-69702HIGHSnailJob 1.7.0 Denial of Service via FuryUtil.deserialize OOMEPSS 0.3%CVE-2026-40182MEDIUMOpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodiesEPSS 0.3%CVE-2025-2533MEDIUMIBM Db2 for Linux denial of serviceEPSS 0.3%CVE-2026-93307MEDIUMO-RAN-SC SMO OAM VES Collector memory allocationEPSS 0.3%CVE-2026-77354HIGHkin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decodingEPSS 0.3%CVE-2026-20048HIGHCisco NX-OS Software SNMP Denial of Service VulnerabilityEPSS 0.3%CVE-2026-32941MEDIUMSliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard TransportsEPSS 0.3%CVE-2026-72656MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceEPSS 0.3%CVE-2026-72639MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of ServiceEPSS 0.3%CVE-2026-72687MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceEPSS 0.3%