Falhas do tipo CWE-789
336 resultadosAlocação descontrolada de memória
Ocorre quando uma aplicação aloca memória em quantidade determinada por entrada do usuário sem validação ou limite. Um atacante fornece valores muito grandes, causando consumo excessivo de RAM, negação de serviço ou travamento do sistema.
Exemplo
Uma API aceita um parâmetro 'tamanho_array' e aloca memória diretamente: malloc(tamanho_array * sizeof(int)). Se o atacante enviar tamanho_array = 2 bilhões, a alocação falha ou consome toda a memória disponível, derrubando o serviço.
Como mitigar
Implemente limites máximos hardcoded para alocações baseadas em entrada externa. Valide e sanitize parâmetros de tamanho antes de usar, rejeitando valores acima de um threshold sensato. Monitore consumo de memória por requisição e implemente rate limiting.
CVE-2026-14454CRITICALImager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signedEPSS 0.7%CVE-2026-115825HIGHHTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-LengthEPSS 0.7%CVE-2026-93019CRITICALImager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_readEPSS 0.7%CVE-2026-82435CRITICALApache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging DecoderEPSS 0.7%CVE-2025-23331HIGHNVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where a user could cause a memory allocation with excessive siEPSS 0.6%CVE-2026-84857MEDIUMsigoden aichat API Endpoint serve.rs memory allocationEPSS 0.6%CVE-2026-88045HIGHrclone: S3 multipart declared-length memory exhaustionEPSS 0.6%CVE-2026-19566HIGHNet::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengthsEPSS 0.6%CVE-2026-54638HIGHtd has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.DecodeEPSS 0.6%CVE-2024-32035MEDIUMMemory Allocation with Excessive Size Value in SixLabors.ImageSharpEPSS 0.6%CVE-2026-22026HIGHCryptoLib Unbounded Memory Allocation in KMC HTTP Response Handler Allows Resource ExhaustionEPSS 0.6%CVE-2026-94626HIGHvLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_sizeEPSS 0.6%CVE-2025-25186MEDIUMNet::IMAP vulnerable to possible DoS by memory exhaustionEPSS 0.6%CVE-2026-33174MEDIUMRails Active Storage has a possible DoS vulnerability when in proxy mode via Range requestsEPSS 0.6%CVE-2026-58060HIGHHSS public-key level count unbounded, enabling huge allocation on verifyEPSS 0.6%CVE-2026-55079MEDIUMCoder's unbounded memory allocation in provisioner file upload allows authenticated denial of serviceEPSS 0.6%CVE-2026-44253MEDIUMWazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str allocation and div_msg_box accumulationEPSS 0.6%CVE-2026-85715HIGHExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory ExhaustionEPSS 0.6%CVE-2026-75935HIGHMemory-amplification denial of service via declared-length preallocation in Amazon ion-javaEPSS 0.6%CVE-2026-77322HIGHSIPGO: DoS via unvalidated WebSocket frame lengthEPSS 0.6%