Fallos del tipo CWE-789

336 resultados

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória sem validar adequadamente o tamanho solicitado, permitindo que um atacante force alocações massivas ou excessivas. Isso leva a consumo desenfreado de RAM, causando negação de serviço (DoS), travamento ou crash da aplicação.

Ejemplo

Um servidor web recebe um parâmetro 'tamanho' do cliente e aloca um buffer: `char *buf = malloc(tamanho_enviado)`. Se um atacante enviar um valor gigantesco (tipo 2GB), a memória se esgota e a aplicação cai. Outro cenário: um parser de arquivo aceita um campo 'quantidade de elementos' sem limite, aloca array gigante e consome toda a RAM disponível.

Cómo mitigar

Valide e estabeleça limites máximos realistas para alocações antes de executá-las. Use tipos com tamanho fixo quando possível, implemente timeouts de alocação e monitore consumo de memória em runtime. Se o tamanho vem de entrada do usuário, rejeite valores suspeitos ou use alocadores com caps configurados.

CVE-2025-71395HIGHSurrealDB before 2.2.2 Memory Exhaustion via string::replaceEPSS 0.4%CVE-2026-25899HIGHFiber is Vulnerable to Denial of Service via Flash Cookie Unbounded AllocationEPSS 0.4%CVE-2025-12983LOWMemory Allocation with Excessive Size Value in GitLabEPSS 0.4%CVE-2026-58067HIGHA vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service.EPSS 0.4%CVE-2026-54448MEDIUMTrivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parserEPSS 0.4%CVE-2026-102509HIGHApache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parserEPSS 0.4%CVE-2026-48502HIGHMessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflowsEPSS 0.4%CVE-2026-42582HIGHNetty: HTTP/3 QPACK literal unbounded allocationEPSS 0.4%CVE-2026-63566HIGHDTLS handshake reassembler allocates buffer from unchecked 24-bit lengthEPSS 0.4%CVE-2026-102731HIGHApache Directory LDAP API: Denial of service via excessive memory allocation in BER decodeEPSS 0.4%CVE-2021-34867HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker muEPSS 0.4%CVE-2026-63574HIGHUnbounded allocation from OpenPGP signature and user attribute subpacket lengthsEPSS 0.4%CVE-2024-41761MEDIUMIBM Db2 denial of serviceEPSS 0.4%CVE-2025-54801HIGHFiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in DecoderEPSS 0.4%CVE-2021-34868HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker muEPSS 0.4%CVE-2026-72639MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of ServiceEPSS 0.4%CVE-2026-72645MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2026-96260MEDIUMMattermost server missing request body size limit on plugin routes allows denial of service by an authenticated userEPSS 0.4%CVE-2026-72687MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2026-54890HIGHBEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decodingEPSS 0.4%