Falhas do tipo CWE-789
336 resultadosAlocação descontrolada de memória
Ocorre quando uma aplicação aloca memória em quantidade determinada por entrada do usuário sem validação ou limite. Um atacante fornece valores muito grandes, causando consumo excessivo de RAM, negação de serviço ou travamento do sistema.
Exemplo
Uma API aceita um parâmetro 'tamanho_array' e aloca memória diretamente: malloc(tamanho_array * sizeof(int)). Se o atacante enviar tamanho_array = 2 bilhões, a alocação falha ou consome toda a memória disponível, derrubando o serviço.
Como mitigar
Implemente limites máximos hardcoded para alocações baseadas em entrada externa. Valide e sanitize parâmetros de tamanho antes de usar, rejeitando valores acima de um threshold sensato. Monitore consumo de memória por requisição e implemente rate limiting.
CVE-2026-32941MEDIUMSliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard TransportsEPSS 0.3%CVE-2026-42348MEDIUMOpAMP client reads unbounded HTTP response bodiesEPSS 0.3%CVE-2026-108683MEDIUMzhayujie CowAgent Media Download memory allocationEPSS 0.3%CVE-2026-85494HIGHApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language)EPSS 0.3%CVE-2026-103005MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceEPSS 0.3%CVE-2026-102463HIGHIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-clientEPSS 0.3%CVE-2026-119280LOWMariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengthsEPSS 0.3%CVE-2026-40182MEDIUMOpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodiesEPSS 0.3%CVE-2025-2534MEDIUMIBM Db2 denial of serviceEPSS 0.3%CVE-2023-20089HIGHCisco Nexus 9000 Series Fabric Switches in ACI Mode Link Layer Discovery Protocol Memory Leak Denial of Service VulnerabilityEPSS 0.3%CVE-2026-83594HIGHApache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it namesEPSS 0.3%CVE-2026-12185HIGHBKS/UBER keystore allocates from untrusted lengths before integrity checkEPSS 0.3%CVE-2026-105749MEDIUMDocling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustionEPSS 0.3%CVE-2021-1283MEDIUMCisco Data Center Network Manager Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-63476MEDIUMisomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS)EPSS 0.3%CVE-2021-47944HIGHmemono Notepad 4.2 Denial of Service via Buffer OverflowEPSS 0.3%CVE-2021-47970HIGHMacaron Notes 5.5 Denial of Service via Buffer OverflowEPSS 0.3%CVE-2026-25780MEDIUMMemory Exhaustion via Malformed DOC File UploadEPSS 0.3%CVE-2021-47972HIGHSticky Notes & Color Widgets 1.4.2 Denial of ServiceEPSS 0.3%CVE-2021-47969HIGHColor Notes 1.4 Denial of Service via Long Character StringEPSS 0.3%