Falhas do tipo CWE-789
336 resultadosAlocação descontrolada de memória
Ocorre quando uma aplicação aloca memória em quantidade determinada por entrada do usuário sem validação ou limite. Um atacante fornece valores muito grandes, causando consumo excessivo de RAM, negação de serviço ou travamento do sistema.
Exemplo
Uma API aceita um parâmetro 'tamanho_array' e aloca memória diretamente: malloc(tamanho_array * sizeof(int)). Se o atacante enviar tamanho_array = 2 bilhões, a alocação falha ou consome toda a memória disponível, derrubando o serviço.
Como mitigar
Implemente limites máximos hardcoded para alocações baseadas em entrada externa. Valide e sanitize parâmetros de tamanho antes de usar, rejeitando valores acima de um threshold sensato. Monitore consumo de memória por requisição e implemente rate limiting.
CVE-2026-26246MEDIUMMemory Exhaustion via Malformed PSD File UploadEPSS 0.2%CVE-2026-41312MEDIUMpypdf: Manipulated FlateDecode predictor parameters can exhaust RAMEPSS 0.2%CVE-2026-41314MEDIUMpypdf: Manipulated FlateDecode image dimensions can exhaust RAMEPSS 0.2%CVE-2026-35186MEDIUMWasmtime has an improperly masked return value from `table.grow` with Winch compiler backendEPSS 0.2%CVE-2026-103582—Apache ActiveMQ NMS OpenWire Client Library: Unbounded/Unvalidated Length Fields in Apache.NMS.OpenWire Unmarshalling (DoS)EPSS 0.2%CVE-2026-107389MEDIUMmusic-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abortEPSS 0.2%CVE-2026-22188MEDIUMPanda3D <= 1.10.16 Deploy-Stub Stack Exhaustion via Unbounded alloca()EPSS 0.2%CVE-2021-1568MEDIUMCisco AnyConnect Secure Mobility Client for Windows Denial of Service VulnerabilityEPSS 0.2%CVE-2026-112214MEDIUMGstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parserEPSS 0.2%CVE-2026-44967MEDIUMopentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP responseEPSS 0.2%CVE-2026-78861HIGHAn issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private KeyEPSS 0.2%CVE-2022-20717MEDIUMCisco SD-WAN vEdge Routers Denial of Service VulnerabilityEPSS 0.2%CVE-2026-39882MEDIUMOpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodiesEPSS 0.2%CVE-2025-4605MEDIUMUSD File Parsing Memory Allocation VulnerabilityEPSS 0.2%CVE-2026-32836MEDIUMmackron / dr_libs dr_flac.h Excessive Memory Allocation in PICTURE Metadata ParsingEPSS 0.2%CVE-2026-107387MEDIUMmusic-metadata: Uncontrolled memory allocation in APEv2 parserEPSS 0.2%CVE-2026-107388MEDIUMmusic-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoSEPSS 0.2%CVE-2026-40891MEDIUMOpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handlingEPSS 0.2%CVE-2026-102820MEDIUMpageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)EPSS 0.2%CVE-2026-47734MEDIUMDulwich has unbounded memory allocation in receive-pack from crafted thin packsEPSS 0.2%