Fallos del tipo CWE-789

336 resultados

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória sem validar adequadamente o tamanho solicitado, permitindo que um atacante force alocações massivas ou excessivas. Isso leva a consumo desenfreado de RAM, causando negação de serviço (DoS), travamento ou crash da aplicação.

Ejemplo

Um servidor web recebe um parâmetro 'tamanho' do cliente e aloca um buffer: `char *buf = malloc(tamanho_enviado)`. Se um atacante enviar um valor gigantesco (tipo 2GB), a memória se esgota e a aplicação cai. Outro cenário: um parser de arquivo aceita um campo 'quantidade de elementos' sem limite, aloca array gigante e consome toda a RAM disponível.

Cómo mitigar

Valide e estabeleça limites máximos realistas para alocações antes de executá-las. Use tipos com tamanho fixo quando possível, implemente timeouts de alocação e monitore consumo de memória em runtime. Se o tamanho vem de entrada do usuário, rejeite valores suspeitos ou use alocadores com caps configurados.

CVE-2026-85715HIGHExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory ExhaustionEPSS 0.6%CVE-2026-77301HIGHadm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)EPSS 0.6%CVE-2026-42440HIGHApache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReaderEPSS 0.6%CVE-2026-21452HIGHMessagePack-Java Vulnerable to Remote Denial of Service via Malicious .msgpack Model File Triggering Unbounded EXT Payload AllocationEPSS 0.6%CVE-2026-56387HIGHApache bRPC: Remote Memory Exhaustion in RTMP AMF ParserEPSS 0.6%CVE-2024-20260HIGHCisco Adaptive Security Virtual Appliance and Secure Firewall Threat Defense Virtual SSL VPN Denial of Service VulnerabilityEPSS 0.6%CVE-2026-111108CRITICALApache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readersEPSS 0.6%CVE-2026-44630HIGHApache IoTDB: RPC service denial of service via unchecked Thrift string lengthEPSS 0.6%CVE-2026-15337MEDIUMPotential denial-of-service vulnerability in check_for_language()EPSS 0.6%CVE-2026-22803HIGHSvelteKit has a memory amplification DoS in Remote Functions binary form deserializerEPSS 0.6%CVE-2026-111279HIGHDragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBEREPSS 0.6%CVE-2026-40006HIGHApache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiverEPSS 0.6%CVE-2026-20295HIGHCisco Secure Firewall Management Center and Secure Firewall Threat Defense Software sftunnel Memory Exhaustion Denial of Service VulnerabilityEPSS 0.6%CVE-2026-59844MEDIUMLibssh: libssh: denial of service via oversized sftp read lengthEPSS 0.6%CVE-2024-35152MEDIUMIBM Db2 denial of serviceEPSS 0.6%CVE-2025-61600HIGHUnbounded Memory Allocation in Stalwart IMAP parserEPSS 0.6%CVE-2026-24030MEDIUMUnbounded memory allocation for DoQ and DoH3EPSS 0.6%CVE-2026-25985HIGHMemory allocation with excessive without limits in the internal SVG decoderEPSS 0.6%CVE-2024-37529MEDIUMIBM Db2 denial of serviceEPSS 0.5%CVE-2026-114349MEDIUMApache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batchesEPSS 0.5%