Falhas do tipo CWE-789
332 resultadosAlocação descontrolada de memória
Ocorre quando uma aplicação aloca memória em quantidade determinada por entrada do usuário sem validação ou limite. Um atacante fornece valores muito grandes, causando consumo excessivo de RAM, negação de serviço ou travamento do sistema.
Exemplo
Uma API aceita um parâmetro 'tamanho_array' e aloca memória diretamente: malloc(tamanho_array * sizeof(int)). Se o atacante enviar tamanho_array = 2 bilhões, a alocação falha ou consome toda a memória disponível, derrubando o serviço.
Como mitigar
Implemente limites máximos hardcoded para alocações baseadas em entrada externa. Valide e sanitize parâmetros de tamanho antes de usar, rejeitando valores acima de um threshold sensato. Monitore consumo de memória por requisição e implemente rate limiting.
CVE-2026-118036HIGHUncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question AnsweringEPSS 0.4%CVE-2025-11579MEDIUMDoS via Out Of Memory CrashEPSS 0.4%CVE-2026-106453MEDIUMyawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryErrorEPSS 0.4%CVE-2026-108106HIGHXerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of ServiceEPSS 0.4%CVE-2026-54700MEDIUMConnectBot SSH: Unbounded SSH field lengths can cause excessive memory allocationEPSS 0.4%CVE-2026-107223HIGHExcelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the processEPSS 0.4%CVE-2026-33374MEDIUMUnbounded memory allocation in the Prometheus rule conversion APIEPSS 0.4%CVE-2024-2494MEDIUMLibvirt: negative g_new0 length can lead to unbounded memory allocationEPSS 0.4%CVE-2026-119278MEDIUMMariaDB Connector/J: Rogue server can crash the client during caching_sha2_password authenticationEPSS 0.4%CVE-2026-35633MEDIUMOpenClaw < 2026.3.22 - Unbounded Memory Allocation via Remote Media Error ResponsesEPSS 0.4%CVE-2025-2533MEDIUMIBM Db2 for Linux denial of serviceEPSS 0.4%CVE-2025-2518MEDIUMIBM Db2 denial of serviceEPSS 0.4%CVE-2025-61910HIGHNASA ION-DTN BPv7 4.1.3s Uncontrolled Memory Allocation that leads to Denial-of-ServiceEPSS 0.4%CVE-2026-44375HIGHNerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowExceptionEPSS 0.4%CVE-2026-119276MEDIUMMariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packetsEPSS 0.4%CVE-2026-115907HIGHzip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed sizeEPSS 0.4%CVE-2026-115417HIGHMemory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqttEPSS 0.4%CVE-2026-8485MEDIUMUncontrolled Memory Allocation vulnerability in Progress Software MOVEit AutomationEPSS 0.3%CVE-2025-29491MEDIUMAn allocation-size-too-big error in the parseSWF_DEFINEBINARYDATA function of libming v0.48 allows attackers to cause a Denial of Service (DEPSS 0.3%CVE-2026-10142HIGHkafka-python prior to 2.3.2 Denial of Service via Protocol Parser Frame LengthEPSS 0.3%