Fallos del tipo CWE-789

251 resultados

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória sem validar adequadamente o tamanho solicitado, permitindo que um atacante force alocações massivas ou excessivas. Isso leva a consumo desenfreado de RAM, causando negação de serviço (DoS), travamento ou crash da aplicação.

Ejemplo

Um servidor web recebe um parâmetro 'tamanho' do cliente e aloca um buffer: `char *buf = malloc(tamanho_enviado)`. Se um atacante enviar um valor gigantesco (tipo 2GB), a memória se esgota e a aplicação cai. Outro cenário: um parser de arquivo aceita um campo 'quantidade de elementos' sem limite, aloca array gigante e consome toda a RAM disponível.

Cómo mitigar

Valide e estabeleça limites máximos realistas para alocações antes de executá-las. Use tipos com tamanho fixo quando possível, implemente timeouts de alocação e monitore consumo de memória em runtime. Se o tamanho vem de entrada do usuário, rejeite valores suspeitos ou use alocadores com caps configurados.

CVE-2025-23331HIGHNVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where a user could cause a memory allocation with excessive siEPSS 0.6%CVE-2026-40006HIGHApache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiverEPSS 0.6%CVE-2026-59844MEDIUMLibssh: libssh: denial of service via oversized sftp read lengthEPSS 0.6%CVE-2024-35152MEDIUMIBM Db2 denial of serviceEPSS 0.6%CVE-2025-61600HIGHUnbounded Memory Allocation in Stalwart IMAP parserEPSS 0.6%CVE-2024-37529MEDIUMIBM Db2 denial of serviceEPSS 0.5%CVE-2026-20295HIGHCisco Secure Firewall Management Center and Secure Firewall Threat Defense Software sftunnel Memory Exhaustion Denial of Service VulnerabilityEPSS 0.5%CVE-2023-43632CRITICALFreely Allocate Buffer on The Stack With Data From SocketEPSS 0.5%CVE-2026-24030MEDIUMUnbounded memory allocation for DoQ and DoH3EPSS 0.5%CVE-2026-88045HIGHrclone: S3 multipart declared-length memory exhaustionEPSS 0.5%CVE-2026-24146HIGHNVIDIA Triton Inference Server contains a vulnerability where insufficient input validation and a large number of outputs could cause a servEPSS 0.5%CVE-2026-33592HIGHFindServers Memory Exhaustion in open62541EPSS 0.5%CVE-2026-11946HIGHGetEndpoints Memory Exhaustion in open62541EPSS 0.5%CVE-2026-59938MEDIUMpypdf: Possible large memory usage for wrong image dimensionsEPSS 0.5%CVE-2026-44253MEDIUMWazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str allocation and div_msg_box accumulationEPSS 0.5%CVE-2026-25985HIGHMemory allocation with excessive without limits in the internal SVG decoderEPSS 0.5%CVE-2025-26618HIGHSSH SFTP packet size not verified properly in Erlang OTPEPSS 0.5%CVE-2026-67589HIGHApache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authenticationEPSS 0.5%CVE-2026-67551HIGHApache Qpid Proton Dotnet: Type size/count handling can lead to excessive allocation pre-authenticationEPSS 0.5%CVE-2026-55213HIGHh2o: musl libc stack overflow (QPACK)EPSS 0.5%