Fallos del tipo CWE-789

336 resultados

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória sem validar adequadamente o tamanho solicitado, permitindo que um atacante force alocações massivas ou excessivas. Isso leva a consumo desenfreado de RAM, causando negação de serviço (DoS), travamento ou crash da aplicação.

Ejemplo

Um servidor web recebe um parâmetro 'tamanho' do cliente e aloca um buffer: `char *buf = malloc(tamanho_enviado)`. Se um atacante enviar um valor gigantesco (tipo 2GB), a memória se esgota e a aplicação cai. Outro cenário: um parser de arquivo aceita um campo 'quantidade de elementos' sem limite, aloca array gigante e consome toda a RAM disponível.

Cómo mitigar

Valide e estabeleça limites máximos realistas para alocações antes de executá-las. Use tipos com tamanho fixo quando possível, implemente timeouts de alocação e monitore consumo de memória em runtime. Se o tamanho vem de entrada do usuário, rejeite valores suspeitos ou use alocadores com caps configurados.

CVE-2025-54151MEDIUMQsync CentralEPSS 0.3%CVE-2026-42241MEDIUMParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type WidthEPSS 0.3%CVE-2023-20202MEDIUMA vulnerability in the Wireless Network Control daemon (wncd) of Cisco IOS XE Software for Wireless LAN Controllers could allow an unauthentEPSS 0.3%CVE-2026-47313MEDIUMMemory allocation with excessive size value vulnerability in Samsung Open Source Escargot allows Excessive Allocation. This issue affects EEPSS 0.3%CVE-2026-111108CRITICALApache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readersEPSS 0.3%CVE-2026-35549MEDIUMAn issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_pEPSS 0.3%CVE-2026-27887MEDIUMSpin has memory leaks in various WIT interfacesEPSS 0.3%CVE-2021-34854HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker EPSS 0.3%CVE-2026-58559MEDIUMDoS vulnerability in the vibration service. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.3%CVE-2023-52429MEDIUMdm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate more than INT_MAX byteEPSS 0.2%CVE-2025-20140HIGHA vulnerability in the Wireless Network Control daemon (wncd) of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unEPSS 0.2%CVE-2026-114349MEDIUMApache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batchesEPSS 0.2%CVE-2026-107215HIGHExcelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoSEPSS 0.2%CVE-2026-89092MEDIUMStack overflow in nscd due to unbounded alloca useEPSS 0.2%CVE-2026-6340MEDIUMMemory Exhaustion via Malicious 7zip File UploadEPSS 0.2%CVE-2026-115865—Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memoryEPSS 0.2%CVE-2026-26246MEDIUMMemory Exhaustion via Malformed PSD File UploadEPSS 0.2%CVE-2026-41312MEDIUMpypdf: Manipulated FlateDecode predictor parameters can exhaust RAMEPSS 0.2%CVE-2026-41314MEDIUMpypdf: Manipulated FlateDecode image dimensions can exhaust RAMEPSS 0.2%CVE-2026-111551HIGHApache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocationEPSS 0.2%