Fallos del tipo CWE-1325

22 resultados

Alocação sequencial de memória descontrolada

Ocorre quando um programa aloca blocos de memória de forma sequencial sem validar adequadamente o tamanho total ou impor limites, permitindo que um atacante force alocações excessivas. Isso pode levar a esgotamento de memória (denial of service), corrupção de heap ou leitura/escrita em regiões não autorizado.

Ejemplo

Um servidor HTTP aloca um buffer para cada chunk de um upload sem verificar se a soma de todos os chunks ultrapassa limites. Um atacante envia múltiplos chunks grandes em sequência, consumindo toda memória do servidor até travar ou ser comprometido.

Cómo mitigar

Implemente quotas e limites globais: controle o total alocado por sessão/usuário, valide cada requisição de alocação contra esse limite antes de executar, e libere recursos se ultrapassar o threshold. Use timeouts e rate-limiting para mitigar o impacto.

CVE-2024-2511MEDIUMUnbounded memory growth with session handling in TLSv1.3EPSS 54.0%CVE-2023-3341HIGHA stack exhaustion flaw in control channel code may cause named to terminate unexpectedlyEPSS 2.6%CVE-2024-27804HIGHThe issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionEPSS 1.3%CVE-2021-43174—gzip transfer encoding caused out-of-memory crashEPSS 1.2%CVE-2026-34183HIGHUnbounded Memory Growth in the QUIC PATH_CHALLENGE HandlerEPSS 1.0%CVE-2025-2240HIGHSmallrye-fault-tolerance: smallrye fault toleranceEPSS 1.0%CVE-2023-28968MEDIUMJunos OS: SRX Series: Policies that rely on JDPI-Decoder actions may fail openEPSS 0.6%CVE-2023-52891MEDIUMA vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.5), SIMATIC Energy Manager PRO (All versions < V7.5),EPSS 0.5%CVE-2026-24819MEDIUMAn out-of-memory (OOM) issue in foxinmy/weixin4jEPSS 0.4%CVE-2026-71436MEDIUMMermaid XY Charts are vulnerable to an infinite loop DoSEPSS 0.3%CVE-2026-54081MEDIUMveraPDF Parser DoS via PostScript Type 1 Font ProgramsEPSS 0.3%CVE-2026-54080MEDIUMveraPDF Parser DoS via PostScript CMap StreamsEPSS 0.3%CVE-2026-13056HIGHA user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAMEPSS 0.3%CVE-2024-27796HIGHThe issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey EPSS 0.3%CVE-2026-8199HIGHPost-auth memory exhaustion via bitwise match expressionsEPSS 0.3%CVE-2026-3201MEDIUMImproperly Controlled Sequential Memory Allocation in WiresharkEPSS 0.2%CVE-2025-13945MEDIUMImproperly Controlled Sequential Memory Allocation in WiresharkEPSS 0.2%CVE-2026-6533MEDIUMImproperly Controlled Sequential Memory Allocation in WiresharkEPSS 0.1%CVE-2026-6535MEDIUMImproperly Controlled Sequential Memory Allocation in WiresharkEPSS 0.1%CVE-2026-18772MEDIUMImproperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion.EPSS 0.1%