Falhas do tipo CWE-789
338 resultadosAlocação descontrolada de memória
Ocorre quando uma aplicação aloca memória em quantidade determinada por entrada do usuário sem validação ou limite. Um atacante fornece valores muito grandes, causando consumo excessivo de RAM, negação de serviço ou travamento do sistema.
Exemplo
Uma API aceita um parâmetro 'tamanho_array' e aloca memória diretamente: malloc(tamanho_array * sizeof(int)). Se o atacante enviar tamanho_array = 2 bilhões, a alocação falha ou consome toda a memória disponível, derrubando o serviço.
Como mitigar
Implemente limites máximos hardcoded para alocações baseadas em entrada externa. Valide e sanitize parâmetros de tamanho antes de usar, rejeitando valores acima de um threshold sensato. Monitore consumo de memória por requisição e implemente rate limiting.
CVE-2024-40680MEDIUMIBM MQ denial of serviceEPSS 0.2%CVE-2026-53428MEDIUMUnbounded memory allocation in highlight_lines range expansion in mdexEPSS 0.2%CVE-2026-29776LOWFreeRDP has an Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core LibraryEPSS 0.2%CVE-2026-66485MEDIUMUncontrolled Memory Allocation in GNU cpioEPSS 0.2%CVE-2026-105613MEDIUMPostgreSQL Anonymizer: Unbounded memory allocation (DoS) in range-based dummy functionsEPSS 0.2%CVE-2026-105614MEDIUMPostgreSQL Anonymizer: Unbounded image-decode memory allocation (DoS) in anon.image_blur()EPSS 0.2%CVE-2026-42146MEDIUMCImg Library: Uncontrolled memory allocation via nb_colors field in _load_bmpEPSS 0.2%CVE-2026-112283MEDIUMlibbluray through 1.5.1 Uncontrolled Memory Allocation via _parse_extent_start_pointsEPSS 0.2%CVE-2026-26931MEDIUMMemory Allocation with Excessive Size Value in Metricbeat Leading to Denial of ServiceEPSS 0.2%CVE-2026-112048MEDIUMlibspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring CountEPSS 0.2%CVE-2022-20845MEDIUMCisco Network Convergence System 4000 Series TL1 Denial of Service VulnerabilityEPSS 0.2%CVE-2026-55782LOWNanaZip: Unbounded memory allocation (DoS) in NanaZip WebAssembly parser via attacker-controlled section/name length fieldsEPSS 0.2%CVE-2026-2456MEDIUMDenial of Service via Unbounded Memory Allocation in Integration ActionsEPSS 0.2%CVE-2026-110258MEDIUMOW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Multiple RET InstructionsEPSS 0.2%CVE-2026-110257MEDIUMOW2 ASM 5.0 before 9.11 Excessive Memory Allocation via BootstrapMethods AttributeEPSS 0.2%CVE-2026-86776MEDIUMKeePass 2.35 through 2.61.1 Memory Exhaustion via KDBX Header Field SizeEPSS 0.2%CVE-2026-62254MEDIUMLibreDWG: excessive class-decoding reallocation in R13-R2000 DWG parsingEPSS 0.2%CVE-2026-115394MEDIUMGhidra through 12.2 Denial of Service via BinaryField Memory AllocationEPSS 0.2%CVE-2026-113604MEDIUMGhidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header CountsEPSS 0.2%CVE-2026-83530MEDIUMUncontrolled Memory Allocation in cel-goEPSS 0.2%