Fallos del tipo CWE-789

251 resultados

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória sem validar adequadamente o tamanho solicitado, permitindo que um atacante force alocações massivas ou excessivas. Isso leva a consumo desenfreado de RAM, causando negação de serviço (DoS), travamento ou crash da aplicação.

Ejemplo

Um servidor web recebe um parâmetro 'tamanho' do cliente e aloca um buffer: `char *buf = malloc(tamanho_enviado)`. Se um atacante enviar um valor gigantesco (tipo 2GB), a memória se esgota e a aplicação cai. Outro cenário: um parser de arquivo aceita um campo 'quantidade de elementos' sem limite, aloca array gigante e consome toda a RAM disponível.

Cómo mitigar

Valide e estabeleça limites máximos realistas para alocações antes de executá-las. Use tipos com tamanho fixo quando possível, implemente timeouts de alocação e monitore consumo de memória em runtime. Se o tamanho vem de entrada do usuário, rejeite valores suspeitos ou use alocadores com caps configurados.

CVE-2026-72645MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceEPSS 0.3%CVE-2023-20089HIGHCisco Nexus 9000 Series Fabric Switches in ACI Mode Link Layer Discovery Protocol Memory Leak Denial of Service VulnerabilityEPSS 0.3%CVE-2026-19204HIGHA client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memoryEPSS 0.3%CVE-2021-47944HIGHmemono Notepad 4.2 Denial of Service via Buffer OverflowEPSS 0.3%CVE-2021-1283MEDIUMCisco Data Center Network Manager Information Disclosure VulnerabilityEPSS 0.3%CVE-2021-47970HIGHMacaron Notes 5.5 Denial of Service via Buffer OverflowEPSS 0.3%CVE-2021-47973HIGHSticky Notes Widget 3.0.6 Denial of Service via Buffer OverflowEPSS 0.3%CVE-2021-47969HIGHColor Notes 1.4 Denial of Service via Long Character StringEPSS 0.3%CVE-2021-47971HIGHMy Notes Safe 5.3 Denial of Service via Buffer OverflowEPSS 0.3%CVE-2021-47972HIGHSticky Notes & Color Widgets 1.4.2 Denial of ServiceEPSS 0.3%CVE-2025-2534MEDIUMIBM Db2 denial of serviceEPSS 0.3%CVE-2026-84888MEDIUMRightNow-AI OpenFang tool_runner.rs shell_exec memory allocationEPSS 0.3%CVE-2026-42241MEDIUMParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type WidthEPSS 0.3%CVE-2026-84289MEDIUMNousResearch hermes-agent MCP Tool mcp_tool.py list_tools memory allocationEPSS 0.3%CVE-2026-25780MEDIUMMemory Exhaustion via Malformed DOC File UploadEPSS 0.3%CVE-2026-47313MEDIUMMemory allocation with excessive size value vulnerability in Samsung Open Source Escargot allows Excessive Allocation. This issue affects EEPSS 0.3%CVE-2026-35549MEDIUMAn issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_pEPSS 0.3%CVE-2021-34854HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker EPSS 0.3%CVE-2025-71395HIGHSurrealDB before 2.2.2 Memory Exhaustion via string::replaceEPSS 0.3%CVE-2026-58559MEDIUMDoS vulnerability in the vibration service. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.3%