Falhas do tipo CWE-789
336 resultadosAlocação descontrolada de memória
Ocorre quando uma aplicação aloca memória em quantidade determinada por entrada do usuário sem validação ou limite. Um atacante fornece valores muito grandes, causando consumo excessivo de RAM, negação de serviço ou travamento do sistema.
Exemplo
Uma API aceita um parâmetro 'tamanho_array' e aloca memória diretamente: malloc(tamanho_array * sizeof(int)). Se o atacante enviar tamanho_array = 2 bilhões, a alocação falha ou consome toda a memória disponível, derrubando o serviço.
Como mitigar
Implemente limites máximos hardcoded para alocações baseadas em entrada externa. Valide e sanitize parâmetros de tamanho antes de usar, rejeitando valores acima de um threshold sensato. Monitore consumo de memória por requisição e implemente rate limiting.
CVE-2026-20048HIGHCisco NX-OS Software SNMP Denial of Service VulnerabilityEPSS 0.3%CVE-2026-82458HIGHApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Container element count not bounded by the bytes availableEPSS 0.3%CVE-2026-83745HIGHApache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D)EPSS 0.3%CVE-2026-5740HIGHUnauthenticated WebSocket binary frame causes denial of service in Mattermost ServerEPSS 0.3%CVE-2026-62297HIGHag-psd has uncontrolled memory allocation via declared PSD dimensions (DoS)EPSS 0.3%CVE-2026-41178MEDIUMOpenTelemetry-Go's baggage parsing no longer caps raw header lengthEPSS 0.3%CVE-2022-22226MEDIUMJunos OS: EX4300-MP, EX4600, QFX5000 Series: In VxLAN scenarios specific packets processed cause a memory leak leading to a PFE crashEPSS 0.3%CVE-2026-106114MEDIUMImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensionsEPSS 0.3%CVE-2026-102510HIGHApache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengthsEPSS 0.3%CVE-2026-103224HIGHIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbounEPSS 0.3%CVE-2026-103223HIGHIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-EPSS 0.3%CVE-2026-33524HIGHZserio: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in DeserializationEPSS 0.3%CVE-2026-28253HIGHMemory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer ConciergeEPSS 0.3%CVE-2026-107390MEDIUMmusic-metadata: MP4 parser allows memory exhaustion via oversized extended atom lengthEPSS 0.3%CVE-2026-42348MEDIUMOpAMP client reads unbounded HTTP response bodiesEPSS 0.3%CVE-2026-108683MEDIUMzhayujie CowAgent Media Download memory allocationEPSS 0.3%CVE-2026-85494HIGHApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language)EPSS 0.3%CVE-2026-32941MEDIUMSliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard TransportsEPSS 0.3%CVE-2026-103005MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceEPSS 0.3%CVE-2026-119280LOWMariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengthsEPSS 0.3%