Falhas do tipo CWE-789
336 resultadosAlocação descontrolada de memória
Ocorre quando uma aplicação aloca memória em quantidade determinada por entrada do usuário sem validação ou limite. Um atacante fornece valores muito grandes, causando consumo excessivo de RAM, negação de serviço ou travamento do sistema.
Exemplo
Uma API aceita um parâmetro 'tamanho_array' e aloca memória diretamente: malloc(tamanho_array * sizeof(int)). Se o atacante enviar tamanho_array = 2 bilhões, a alocação falha ou consome toda a memória disponível, derrubando o serviço.
Como mitigar
Implemente limites máximos hardcoded para alocações baseadas em entrada externa. Valide e sanitize parâmetros de tamanho antes de usar, rejeitando valores acima de um threshold sensato. Monitore consumo de memória por requisição e implemente rate limiting.
CVE-2025-54151MEDIUMQsync CentralEPSS 0.3%CVE-2026-42241MEDIUMParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type WidthEPSS 0.3%CVE-2023-20202MEDIUMA vulnerability in the Wireless Network Control daemon (wncd) of Cisco IOS XE Software for Wireless LAN Controllers could allow an unauthentEPSS 0.3%CVE-2026-47313MEDIUMMemory allocation with excessive size value vulnerability in Samsung Open Source Escargot allows Excessive Allocation.
This issue affects EEPSS 0.3%CVE-2026-111108CRITICALApache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readersEPSS 0.3%CVE-2026-35549MEDIUMAn issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_pEPSS 0.3%CVE-2026-27887MEDIUMSpin has memory leaks in various WIT interfacesEPSS 0.3%CVE-2021-34854HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker EPSS 0.3%CVE-2026-58559MEDIUMDoS vulnerability in the vibration service. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.3%CVE-2023-52429MEDIUMdm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate more than INT_MAX byteEPSS 0.2%CVE-2025-20140HIGHA vulnerability in the Wireless Network Control daemon (wncd) of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unEPSS 0.2%CVE-2026-114349MEDIUMApache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batchesEPSS 0.2%CVE-2026-107215HIGHExcelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoSEPSS 0.2%CVE-2026-89092MEDIUMStack overflow in nscd due to unbounded alloca useEPSS 0.2%CVE-2026-6340MEDIUMMemory Exhaustion via Malicious 7zip File UploadEPSS 0.2%CVE-2026-115865—Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memoryEPSS 0.2%CVE-2026-26246MEDIUMMemory Exhaustion via Malformed PSD File UploadEPSS 0.2%CVE-2026-41312MEDIUMpypdf: Manipulated FlateDecode predictor parameters can exhaust RAMEPSS 0.2%CVE-2026-41314MEDIUMpypdf: Manipulated FlateDecode image dimensions can exhaust RAMEPSS 0.2%CVE-2026-111551HIGHApache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocationEPSS 0.2%