Falhas do tipo CWE-789
251 resultadosAlocação descontrolada de memória
Ocorre quando uma aplicação aloca memória em quantidade determinada por entrada do usuário sem validação ou limite. Um atacante fornece valores muito grandes, causando consumo excessivo de RAM, negação de serviço ou travamento do sistema.
Exemplo
Uma API aceita um parâmetro 'tamanho_array' e aloca memória diretamente: malloc(tamanho_array * sizeof(int)). Se o atacante enviar tamanho_array = 2 bilhões, a alocação falha ou consome toda a memória disponível, derrubando o serviço.
Como mitigar
Implemente limites máximos hardcoded para alocações baseadas em entrada externa. Valide e sanitize parâmetros de tamanho antes de usar, rejeitando valores acima de um threshold sensato. Monitore consumo de memória por requisição e implemente rate limiting.
CVE-2022-31804HIGHCODESYS Gateway server prone to denial of service attack due to excessive memory allocationEPSS 1.1%CVE-2023-6516HIGHSpecific recursive query patterns may lead to an out-of-memory conditionEPSS 1.1%CVE-2026-15337MEDIUMPotential denial-of-service vulnerability in check_for_language()EPSS 1.0%CVE-2023-20108HIGHA vulnerability in the XCP Authentication Service of the Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&PEPSS 0.9%CVE-2026-42946HIGHNGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerabilityEPSS 0.9%CVE-2023-39203MEDIUMUncontrolled resource consumption in Zoom Team Chat for Zoom Desktop Client for Windows and Zoom VDI Client may allow an unauthenticated useEPSS 0.9%CVE-2023-37279HIGHFaktory Web Dashboard can lead to denial of service(DOS) via malicious user inputEPSS 0.9%CVE-2023-24201CRITICALRaffle Draw System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at get_ticket.php.EPSS 0.9%CVE-2026-66733HIGHSonic 3 A.I.R. Unbounded Memory Allocation DoS via ReceivedPacketCacheEPSS 0.9%CVE-2025-20165HIGHCisco BroadWorks SIP Denial of Service VulnerabilityEPSS 0.9%CVE-2023-3171HIGHEap-7: heap exhaustion via deserializationEPSS 0.9%CVE-2026-42154HIGHPrometheus: remote read endpoint allows denial of service via crafted snappy payloadEPSS 0.8%CVE-2026-65315HIGHOllama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata ParserEPSS 0.8%CVE-2024-41132MEDIUMSixLabors ImageSharp Allows Excessive Memory Allocation in Gif DecoderEPSS 0.8%CVE-2022-4741MEDIUMdocconv XMLToText memory allocationEPSS 0.8%CVE-2026-55407MEDIUMBuffa: Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded AllocationEPSS 0.8%CVE-2024-52791MEDIUMDenial of service through memory exhaustion in Matrix Media RepoEPSS 0.8%CVE-2026-53916HIGHApache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codecEPSS 0.7%CVE-2026-50734HIGHApache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negotiationEPSS 0.7%CVE-2026-53917HIGHApache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshallingEPSS 0.7%