Weaknesses of type CWE-789

336 results

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória de forma proporcional a entrada do usuário sem validar limites, permitindo que um atacante force a alocação de quantidades excessivas de RAM. Isso causa consumo de memória em massa (DoS) ou até crash da aplicação.

Example

Um servidor web que redimensiona um buffer baseado no header Content-Length enviado pelo cliente sem checá-lo contra um máximo razoável. Um atacante envia Content-Length: 999999999, forçando a alocação de gigabytes de memória instantaneamente e derrubando o serviço.

How to mitigate

Defina e enforce limites máximos de memória por operação — valide tamanhos de entrada contra thresholds conhecidos antes de alocar. Use mecanismos do SO (ulimit, cgroups) para restringir memória por processo como última linha de defesa.

CVE-2025-71395HIGHSurrealDB before 2.2.2 Memory Exhaustion via string::replaceEPSS 0.4%CVE-2026-25899HIGHFiber is Vulnerable to Denial of Service via Flash Cookie Unbounded AllocationEPSS 0.4%CVE-2025-12983LOWMemory Allocation with Excessive Size Value in GitLabEPSS 0.4%CVE-2026-58067HIGHA vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service.EPSS 0.4%CVE-2026-54448MEDIUMTrivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parserEPSS 0.4%CVE-2026-102509HIGHApache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parserEPSS 0.4%CVE-2026-48502HIGHMessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflowsEPSS 0.4%CVE-2026-42582HIGHNetty: HTTP/3 QPACK literal unbounded allocationEPSS 0.4%CVE-2026-63566HIGHDTLS handshake reassembler allocates buffer from unchecked 24-bit lengthEPSS 0.4%CVE-2026-102731HIGHApache Directory LDAP API: Denial of service via excessive memory allocation in BER decodeEPSS 0.4%CVE-2021-34867HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker muEPSS 0.4%CVE-2026-63574HIGHUnbounded allocation from OpenPGP signature and user attribute subpacket lengthsEPSS 0.4%CVE-2024-41761MEDIUMIBM Db2 denial of serviceEPSS 0.4%CVE-2025-54801HIGHFiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in DecoderEPSS 0.4%CVE-2021-34868HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker muEPSS 0.4%CVE-2026-72639MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of ServiceEPSS 0.4%CVE-2026-72645MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2026-96260MEDIUMMattermost server missing request body size limit on plugin routes allows denial of service by an authenticated userEPSS 0.4%CVE-2026-72687MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2026-54890HIGHBEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decodingEPSS 0.4%