Fallos del tipo CWE-789

336 resultados

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória sem validar adequadamente o tamanho solicitado, permitindo que um atacante force alocações massivas ou excessivas. Isso leva a consumo desenfreado de RAM, causando negação de serviço (DoS), travamento ou crash da aplicação.

Ejemplo

Um servidor web recebe um parâmetro 'tamanho' do cliente e aloca um buffer: `char *buf = malloc(tamanho_enviado)`. Se um atacante enviar um valor gigantesco (tipo 2GB), a memória se esgota e a aplicação cai. Outro cenário: um parser de arquivo aceita um campo 'quantidade de elementos' sem limite, aloca array gigante e consome toda a RAM disponível.

Cómo mitigar

Valide e estabeleça limites máximos realistas para alocações antes de executá-las. Use tipos com tamanho fixo quando possível, implemente timeouts de alocação e monitore consumo de memória em runtime. Se o tamanho vem de entrada do usuário, rejeite valores suspeitos ou use alocadores com caps configurados.

CVE-2026-72656MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2026-118590MEDIUMnipy nibabel Header volumeutils.py array_from_file memory allocationEPSS 0.4%CVE-2021-34869HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker muEPSS 0.4%CVE-2026-54060HIGHPillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`EPSS 0.4%CVE-2026-46603HIGHExcessive memory allocation during VP8L decoding in golang.org/x/imageEPSS 0.4%CVE-2026-24158HIGHNVIDIA Triton Inference Server contains a vulnerability in the HTTP endpoint where an attacker may cause a denial of service by providing a EPSS 0.4%CVE-2026-54059HIGHPillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loadingEPSS 0.4%CVE-2025-53893HIGHFile Browser Vulnerable to Uncontrolled Memory Consumption Due to Oversized File ProcessingEPSS 0.4%CVE-2026-118589MEDIUMnschloe meshio VTK Reader _vtk_42.py memory allocationEPSS 0.4%CVE-2026-27204MEDIUMWasmtime WASI implementations are vulnerable to guest-controlled resource exhaustionEPSS 0.4%CVE-2025-62599HIGHeprosima Fast DDS affected by Out-of-Memory in readPropertySeq via Manipulated DATA Submessage when DDS Security is enabledEPSS 0.4%CVE-2026-122129MEDIUMCESNET ipfixcol2 2.7.1 before 2.9.0 Memory Exhaustion via TCP LZ4 DecoderEPSS 0.4%CVE-2026-42528MEDIUMApache HTTP Server: mod_dav shared lock overflowEPSS 0.4%CVE-2026-102504HIGHImager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiolEPSS 0.4%CVE-2026-88382HIGHhiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser.EPSS 0.4%CVE-2025-2668MEDIUMIBM Db2 Denial of ServiceEPSS 0.4%CVE-2024-41762MEDIUMIBM Db2 denial of serviceEPSS 0.4%CVE-2026-70377HIGHimagecli - Uncontrolled Memory Allocation via Unbounded scale Ratio Causes Denial of ServiceEPSS 0.4%CVE-2026-61845HIGHCrass: Large numeric exponents cause CPU and memory denial of serviceEPSS 0.4%CVE-2018-25368HIGHNord VPN 6.14.31 Denial of Service via Password FieldEPSS 0.4%