Falhas do tipo CWE-789

251 resultados

Alocação descontrolada de memória

Ocorre quando uma aplicação aloca memória em quantidade determinada por entrada do usuário sem validação ou limite. Um atacante fornece valores muito grandes, causando consumo excessivo de RAM, negação de serviço ou travamento do sistema.

Exemplo

Uma API aceita um parâmetro 'tamanho_array' e aloca memória diretamente: malloc(tamanho_array * sizeof(int)). Se o atacante enviar tamanho_array = 2 bilhões, a alocação falha ou consome toda a memória disponível, derrubando o serviço.

Como mitigar

Implemente limites máximos hardcoded para alocações baseadas em entrada externa. Valide e sanitize parâmetros de tamanho antes de usar, rejeitando valores acima de um threshold sensato. Monitore consumo de memória por requisição e implemente rate limiting.

CVE-2026-72645MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceEPSS 0.3%CVE-2023-20089HIGHCisco Nexus 9000 Series Fabric Switches in ACI Mode Link Layer Discovery Protocol Memory Leak Denial of Service VulnerabilityEPSS 0.3%CVE-2026-19204HIGHA client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memoryEPSS 0.3%CVE-2021-47973HIGHSticky Notes Widget 3.0.6 Denial of Service via Buffer OverflowEPSS 0.3%CVE-2021-1283MEDIUMCisco Data Center Network Manager Information Disclosure VulnerabilityEPSS 0.3%CVE-2021-47970HIGHMacaron Notes 5.5 Denial of Service via Buffer OverflowEPSS 0.3%CVE-2021-47944HIGHmemono Notepad 4.2 Denial of Service via Buffer OverflowEPSS 0.3%CVE-2021-47969HIGHColor Notes 1.4 Denial of Service via Long Character StringEPSS 0.3%CVE-2021-47971HIGHMy Notes Safe 5.3 Denial of Service via Buffer OverflowEPSS 0.3%CVE-2021-47972HIGHSticky Notes & Color Widgets 1.4.2 Denial of ServiceEPSS 0.3%CVE-2025-2534MEDIUMIBM Db2 denial of serviceEPSS 0.3%CVE-2026-84888MEDIUMRightNow-AI OpenFang tool_runner.rs shell_exec memory allocationEPSS 0.3%CVE-2026-42241MEDIUMParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type WidthEPSS 0.3%CVE-2026-84289MEDIUMNousResearch hermes-agent MCP Tool mcp_tool.py list_tools memory allocationEPSS 0.3%CVE-2026-25780MEDIUMMemory Exhaustion via Malformed DOC File UploadEPSS 0.3%CVE-2026-47313MEDIUMMemory allocation with excessive size value vulnerability in Samsung Open Source Escargot allows Excessive Allocation. This issue affects EEPSS 0.3%CVE-2026-35549MEDIUMAn issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_pEPSS 0.3%CVE-2021-34854HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker EPSS 0.3%CVE-2025-71395HIGHSurrealDB before 2.2.2 Memory Exhaustion via string::replaceEPSS 0.3%CVE-2026-58559MEDIUMDoS vulnerability in the vibration service. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.3%