Falhas do tipo CWE-789
336 resultadosAlocação descontrolada de memória
Ocorre quando uma aplicação aloca memória em quantidade determinada por entrada do usuário sem validação ou limite. Um atacante fornece valores muito grandes, causando consumo excessivo de RAM, negação de serviço ou travamento do sistema.
Exemplo
Uma API aceita um parâmetro 'tamanho_array' e aloca memória diretamente: malloc(tamanho_array * sizeof(int)). Se o atacante enviar tamanho_array = 2 bilhões, a alocação falha ou consome toda a memória disponível, derrubando o serviço.
Como mitigar
Implemente limites máximos hardcoded para alocações baseadas em entrada externa. Valide e sanitize parâmetros de tamanho antes de usar, rejeitando valores acima de um threshold sensato. Monitore consumo de memória por requisição e implemente rate limiting.
CVE-2026-72656MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2026-118590MEDIUMnipy nibabel Header volumeutils.py array_from_file memory allocationEPSS 0.4%CVE-2021-34869HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker muEPSS 0.4%CVE-2026-54060HIGHPillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`EPSS 0.4%CVE-2026-46603HIGHExcessive memory allocation during VP8L decoding in golang.org/x/imageEPSS 0.4%CVE-2026-24158HIGHNVIDIA Triton Inference Server contains a vulnerability in the HTTP endpoint where an attacker may cause a denial of service by providing a EPSS 0.4%CVE-2026-54059HIGHPillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loadingEPSS 0.4%CVE-2025-53893HIGHFile Browser Vulnerable to Uncontrolled Memory Consumption Due to Oversized File ProcessingEPSS 0.4%CVE-2026-118589MEDIUMnschloe meshio VTK Reader _vtk_42.py memory allocationEPSS 0.4%CVE-2026-27204MEDIUMWasmtime WASI implementations are vulnerable to guest-controlled resource exhaustionEPSS 0.4%CVE-2025-62599HIGHeprosima Fast DDS affected by Out-of-Memory in readPropertySeq via Manipulated DATA Submessage when DDS Security is enabledEPSS 0.4%CVE-2026-122129MEDIUMCESNET ipfixcol2 2.7.1 before 2.9.0 Memory Exhaustion via TCP LZ4 DecoderEPSS 0.4%CVE-2026-42528MEDIUMApache HTTP Server: mod_dav shared lock overflowEPSS 0.4%CVE-2026-102504HIGHImager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiolEPSS 0.4%CVE-2026-88382HIGHhiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser.EPSS 0.4%CVE-2025-2668MEDIUMIBM Db2 Denial of ServiceEPSS 0.4%CVE-2024-41762MEDIUMIBM Db2 denial of serviceEPSS 0.4%CVE-2026-70377HIGHimagecli - Uncontrolled Memory Allocation via Unbounded scale Ratio Causes Denial of ServiceEPSS 0.4%CVE-2026-61845HIGHCrass: Large numeric exponents cause CPU and memory denial of serviceEPSS 0.4%CVE-2018-25368HIGHNord VPN 6.14.31 Denial of Service via Password FieldEPSS 0.4%