Falhas do tipo CWE-789
336 resultadosAlocação descontrolada de memória
Ocorre quando uma aplicação aloca memória em quantidade determinada por entrada do usuário sem validação ou limite. Um atacante fornece valores muito grandes, causando consumo excessivo de RAM, negação de serviço ou travamento do sistema.
Exemplo
Uma API aceita um parâmetro 'tamanho_array' e aloca memória diretamente: malloc(tamanho_array * sizeof(int)). Se o atacante enviar tamanho_array = 2 bilhões, a alocação falha ou consome toda a memória disponível, derrubando o serviço.
Como mitigar
Implemente limites máximos hardcoded para alocações baseadas em entrada externa. Valide e sanitize parâmetros de tamanho antes de usar, rejeitando valores acima de um threshold sensato. Monitore consumo de memória por requisição e implemente rate limiting.
CVE-2026-40378HIGHWindows Local Security Authority Subsystem Service (LSASS) Denial of Service VulnerabilityEPSS 1.2%CVE-2022-31804HIGHCODESYS Gateway server prone to denial of service attack due to excessive memory allocationEPSS 1.2%CVE-2023-6516HIGHSpecific recursive query patterns may lead to an out-of-memory conditionEPSS 1.1%CVE-2023-3171HIGHEap-7: heap exhaustion via deserializationEPSS 1.0%CVE-2023-20108HIGHA vulnerability in the XCP Authentication Service of the Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&PEPSS 0.9%CVE-2026-42946HIGHNGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerabilityEPSS 0.9%CVE-2023-39203MEDIUMUncontrolled resource consumption in Zoom Team Chat for Zoom Desktop Client for Windows and Zoom VDI Client may allow an unauthenticated useEPSS 0.9%CVE-2023-37279HIGHFaktory Web Dashboard can lead to denial of service(DOS) via malicious user inputEPSS 0.9%CVE-2026-71314HIGHNuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island renderingEPSS 0.9%CVE-2023-24201CRITICALRaffle Draw System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at get_ticket.php.EPSS 0.9%CVE-2026-15567HIGHWildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listenerEPSS 0.9%CVE-2025-20165HIGHCisco BroadWorks SIP Denial of Service VulnerabilityEPSS 0.9%CVE-2022-4741MEDIUMdocconv XMLToText memory allocationEPSS 0.8%CVE-2026-42154HIGHPrometheus: remote read endpoint allows denial of service via crafted snappy payloadEPSS 0.8%CVE-2026-65315HIGHOllama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata ParserEPSS 0.8%CVE-2024-52791MEDIUMDenial of service through memory exhaustion in Matrix Media RepoEPSS 0.8%CVE-2026-85445HIGHMOOS-IvP through 24.8.1 BHV_IPF Demultiplexer Memory Exhaustion via Packet CountEPSS 0.8%CVE-2026-67589HIGHApache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authenticationEPSS 0.8%CVE-2026-66273HIGHApache Qpid Proton-J: Type size/count handling can lead to excessive allocation pre-authenticationEPSS 0.8%CVE-2024-41132MEDIUMSixLabors ImageSharp Allows Excessive Memory Allocation in Gif DecoderEPSS 0.8%