Fallos del tipo CWE-789

251 resultados

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória sem validar adequadamente o tamanho solicitado, permitindo que um atacante force alocações massivas ou excessivas. Isso leva a consumo desenfreado de RAM, causando negação de serviço (DoS), travamento ou crash da aplicação.

Ejemplo

Um servidor web recebe um parâmetro 'tamanho' do cliente e aloca um buffer: `char *buf = malloc(tamanho_enviado)`. Se um atacante enviar um valor gigantesco (tipo 2GB), a memória se esgota e a aplicação cai. Outro cenário: um parser de arquivo aceita um campo 'quantidade de elementos' sem limite, aloca array gigante e consome toda a RAM disponível.

Cómo mitigar

Valide e estabeleça limites máximos realistas para alocações antes de executá-las. Use tipos com tamanho fixo quando possível, implemente timeouts de alocação e monitore consumo de memória em runtime. Se o tamanho vem de entrada do usuário, rejeite valores suspeitos ou use alocadores com caps configurados.

CVE-2026-53717MEDIUMEnvoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar headerEPSS 0.7%CVE-2023-0809MEDIUMIn Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packets.EPSS 0.7%CVE-2026-43868MEDIUMApache Thrift: Rust implementation vulnerable to CVE-2020-13949 patternEPSS 0.7%CVE-2024-35116MEDIUMIBM MQ denial of serviceEPSS 0.7%CVE-2023-30837HIGHVyper storage allocator overflowEPSS 0.7%CVE-2026-53716MEDIUMEnvoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limitEPSS 0.7%CVE-2024-37168MEDIUM@grpc/grpc-js can allocate memory for incoming messages well above configured limitsEPSS 0.7%CVE-2026-14454CRITICALImager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signedEPSS 0.7%CVE-2026-58060HIGHHSS public-key level count unbounded, enabling huge allocation on verifyEPSS 0.7%CVE-2025-25186MEDIUMNet::IMAP vulnerable to possible DoS by memory exhaustionEPSS 0.6%CVE-2024-32035MEDIUMMemory Allocation with Excessive Size Value in SixLabors.ImageSharpEPSS 0.6%CVE-2026-22026HIGHCryptoLib Unbounded Memory Allocation in KMC HTTP Response Handler Allows Resource ExhaustionEPSS 0.6%CVE-2026-21452HIGHMessagePack-Java Vulnerable to Remote Denial of Service via Malicious .msgpack Model File Triggering Unbounded EXT Payload AllocationEPSS 0.6%CVE-2026-55079MEDIUMCoder's unbounded memory allocation in provisioner file upload allows authenticated denial of serviceEPSS 0.6%CVE-2026-33174MEDIUMRails Active Storage has a possible DoS vulnerability when in proxy mode via Range requestsEPSS 0.6%CVE-2026-82435CRITICALApache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging DecoderEPSS 0.6%CVE-2026-93019CRITICALImager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_readEPSS 0.6%CVE-2026-42440HIGHApache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReaderEPSS 0.6%CVE-2026-22803HIGHSvelteKit has a memory amplification DoS in Remote Functions binary form deserializerEPSS 0.6%CVE-2024-20260HIGHCisco Adaptive Security Virtual Appliance and Secure Firewall Threat Defense Virtual SSL VPN Denial of Service VulnerabilityEPSS 0.6%