Falhas do tipo CWE-789
202 resultadosAlocação descontrolada de memória
Ocorre quando uma aplicação aloca memória em quantidade determinada por entrada do usuário sem validação ou limite. Um atacante fornece valores muito grandes, causando consumo excessivo de RAM, negação de serviço ou travamento do sistema.
Exemplo
Uma API aceita um parâmetro 'tamanho_array' e aloca memória diretamente: malloc(tamanho_array * sizeof(int)). Se o atacante enviar tamanho_array = 2 bilhões, a alocação falha ou consome toda a memória disponível, derrubando o serviço.
Como mitigar
Implemente limites máximos hardcoded para alocações baseadas em entrada externa. Valide e sanitize parâmetros de tamanho antes de usar, rejeitando valores acima de um threshold sensato. Monitore consumo de memória por requisição e implemente rate limiting.
CVE-2022-30522—mod_sed denial of serviceEPSS 90.4%CVE-2026-49975HIGHApache HTTP Server: mod_http2 denial of serviceEPSS 28.0%CVE-2025-27533MEDIUMApache ActiveMQ: Unchecked buffer length can cause excessive memory allocationEPSS 8.5%CVE-2017-7651—In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of connections with large EPSS 5.3%CVE-2021-31811—A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny fileEPSS 3.4%CVE-2021-27906—A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the fileEPSS 3.3%CVE-2024-43484HIGH.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityEPSS 2.9%CVE-2018-12541—In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the hEPSS 2.7%CVE-2020-8552MEDIUMKubernetes API server denial of serviceEPSS 2.4%CVE-2023-3223HIGHUndertow: outofmemoryerror due to @multipartconfig handlingEPSS 2.0%CVE-2017-7652—In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers EPSS 1.7%CVE-2020-24685HIGHAC500 V2 unauthenticated crafter packet vulnerabilityEPSS 1.6%CVE-2022-22188HIGHJunos OS: QFX5100/QFX5110/QFX5120/QFX5200/QFX5210/EX4600/EX4650 Series: When storm control profiling is enabled and a device is under an active storm, a Heap-based Buffer Overflow in the PFE will cause a device to hang.EPSS 1.5%CVE-2017-20016MEDIUMWEKA INTEREST Security Scanner Portscan memory allocationEPSS 1.4%CVE-2020-5303LOWDenial of service in TendermintEPSS 1.3%CVE-2022-34917HIGHUnauthenticated clients may cause OutOfMemoryError on Apache Kafka BrokersEPSS 1.3%CVE-2020-3596MEDIUMCisco Expressway Series and TelePresence Video Communication Server Denial of Service VulnerabilityEPSS 1.2%CVE-2026-53917HIGHApache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshallingEPSS 1.2%CVE-2020-8551MEDIUMKubernetes kubelet denial of serviceEPSS 1.1%CVE-2023-6516HIGHSpecific recursive query patterns may lead to an out-of-memory conditionEPSS 1.1%