Falhas do tipo CWE-789
336 resultadosAlocação descontrolada de memória
Ocorre quando uma aplicação aloca memória em quantidade determinada por entrada do usuário sem validação ou limite. Um atacante fornece valores muito grandes, causando consumo excessivo de RAM, negação de serviço ou travamento do sistema.
Exemplo
Uma API aceita um parâmetro 'tamanho_array' e aloca memória diretamente: malloc(tamanho_array * sizeof(int)). Se o atacante enviar tamanho_array = 2 bilhões, a alocação falha ou consome toda a memória disponível, derrubando o serviço.
Como mitigar
Implemente limites máximos hardcoded para alocações baseadas em entrada externa. Valide e sanitize parâmetros de tamanho antes de usar, rejeitando valores acima de um threshold sensato. Monitore consumo de memória por requisição e implemente rate limiting.
CVE-2026-67589HIGHApache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authenticationEPSS 0.8%CVE-2026-85442HIGHMOOS core-moos through 10.4.0 MOOSDB Denial of Service via Unbounded Packet AllocationEPSS 0.8%CVE-2026-55407MEDIUMBuffa: Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded AllocationEPSS 0.8%CVE-2026-85324HIGHActive Directory Federation Services (AD FS) Denial of Service VulnerabilityEPSS 0.8%CVE-2026-53917HIGHApache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshallingEPSS 0.7%CVE-2026-53916HIGHApache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codecEPSS 0.7%CVE-2026-67211HIGHApache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializerEPSS 0.7%CVE-2026-50734HIGHApache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negotiationEPSS 0.7%CVE-2026-91752HIGHGNU libextractor before 1.15 Stack Overflow via OLE2EPSS 0.7%CVE-2026-69219HIGHRabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocationEPSS 0.7%CVE-2026-55149HIGHVouch Proxy: Unbounded Multipart Cookie Allocation DoSEPSS 0.7%CVE-2026-53716MEDIUMEnvoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limitEPSS 0.7%CVE-2026-53717MEDIUMEnvoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar headerEPSS 0.7%CVE-2023-0809MEDIUMIn Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packets.EPSS 0.7%CVE-2026-43868MEDIUMApache Thrift: Rust implementation vulnerable to CVE-2020-13949 patternEPSS 0.7%CVE-2024-35116MEDIUMIBM MQ denial of serviceEPSS 0.7%CVE-2023-30837HIGHVyper storage allocator overflowEPSS 0.7%CVE-2024-37168MEDIUM@grpc/grpc-js can allocate memory for incoming messages well above configured limitsEPSS 0.7%CVE-2026-108359HIGHPhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)EPSS 0.7%CVE-2023-43632CRITICALFreely Allocate Buffer on The Stack With Data From SocketEPSS 0.7%