Fallos del tipo CWE-789

251 resultados

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória sem validar adequadamente o tamanho solicitado, permitindo que um atacante force alocações massivas ou excessivas. Isso leva a consumo desenfreado de RAM, causando negação de serviço (DoS), travamento ou crash da aplicação.

Ejemplo

Um servidor web recebe um parâmetro 'tamanho' do cliente e aloca um buffer: `char *buf = malloc(tamanho_enviado)`. Se um atacante enviar um valor gigantesco (tipo 2GB), a memória se esgota e a aplicação cai. Outro cenário: um parser de arquivo aceita um campo 'quantidade de elementos' sem limite, aloca array gigante e consome toda a RAM disponível.

Cómo mitigar

Valide e estabeleça limites máximos realistas para alocações antes de executá-las. Use tipos com tamanho fixo quando possível, implemente timeouts de alocação e monitore consumo de memória em runtime. Se o tamanho vem de entrada do usuário, rejeite valores suspeitos ou use alocadores com caps configurados.

CVE-2022-31804HIGHCODESYS Gateway server prone to denial of service attack due to excessive memory allocationEPSS 1.1%CVE-2023-6516HIGHSpecific recursive query patterns may lead to an out-of-memory conditionEPSS 1.1%CVE-2026-15337MEDIUMPotential denial-of-service vulnerability in check_for_language()EPSS 1.0%CVE-2023-20108HIGHA vulnerability in the XCP Authentication Service of the Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&PEPSS 0.9%CVE-2026-42946HIGHNGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerabilityEPSS 0.9%CVE-2023-39203MEDIUMUncontrolled resource consumption in Zoom Team Chat for Zoom Desktop Client for Windows and Zoom VDI Client may allow an unauthenticated useEPSS 0.9%CVE-2023-37279HIGHFaktory Web Dashboard can lead to denial of service(DOS) via malicious user inputEPSS 0.9%CVE-2023-24201CRITICALRaffle Draw System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at get_ticket.php.EPSS 0.9%CVE-2026-66733HIGHSonic 3 A.I.R. Unbounded Memory Allocation DoS via ReceivedPacketCacheEPSS 0.9%CVE-2025-20165HIGHCisco BroadWorks SIP Denial of Service VulnerabilityEPSS 0.9%CVE-2023-3171HIGHEap-7: heap exhaustion via deserializationEPSS 0.9%CVE-2026-42154HIGHPrometheus: remote read endpoint allows denial of service via crafted snappy payloadEPSS 0.8%CVE-2026-65315HIGHOllama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata ParserEPSS 0.8%CVE-2024-41132MEDIUMSixLabors ImageSharp Allows Excessive Memory Allocation in Gif DecoderEPSS 0.8%CVE-2022-4741MEDIUMdocconv XMLToText memory allocationEPSS 0.8%CVE-2026-55407MEDIUMBuffa: Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded AllocationEPSS 0.8%CVE-2024-52791MEDIUMDenial of service through memory exhaustion in Matrix Media RepoEPSS 0.8%CVE-2026-53916HIGHApache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codecEPSS 0.7%CVE-2026-50734HIGHApache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negotiationEPSS 0.7%CVE-2026-53917HIGHApache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshallingEPSS 0.7%