Falhas do tipo CWE-789
251 resultadosAlocação descontrolada de memória
Ocorre quando uma aplicação aloca memória em quantidade determinada por entrada do usuário sem validação ou limite. Um atacante fornece valores muito grandes, causando consumo excessivo de RAM, negação de serviço ou travamento do sistema.
Exemplo
Uma API aceita um parâmetro 'tamanho_array' e aloca memória diretamente: malloc(tamanho_array * sizeof(int)). Se o atacante enviar tamanho_array = 2 bilhões, a alocação falha ou consome toda a memória disponível, derrubando o serviço.
Como mitigar
Implemente limites máximos hardcoded para alocações baseadas em entrada externa. Valide e sanitize parâmetros de tamanho antes de usar, rejeitando valores acima de um threshold sensato. Monitore consumo de memória por requisição e implemente rate limiting.
CVE-2026-55213HIGHh2o: musl libc stack overflow (QPACK)EPSS 0.5%CVE-2026-44453HIGHh2o is vulnerable to musl libc stack overflowEPSS 0.5%CVE-2023-5371MEDIUMMemory Allocation with Excessive Size Value in WiresharkEPSS 0.5%CVE-2026-42189HIGHRussh: Pre-auth DoS via unbounded allocation in keyboard-interactive authEPSS 0.5%CVE-2023-33953HIGHDenial-of-Service in gRPCEPSS 0.5%CVE-2025-3632HIGHIBM 4769 Developers Toolkit denial of serviceEPSS 0.5%CVE-2026-25579CRITICALNavidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpointsEPSS 0.5%CVE-2025-43857MEDIUMnet-imap rubygem vulnerable to possible DoS by memory exhaustionEPSS 0.5%CVE-2026-67211HIGHApache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializerEPSS 0.5%CVE-2026-15567HIGHWildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listenerEPSS 0.5%CVE-2026-15053HIGHTanium addressed a denial of service vulnerability in Tanium Server.EPSS 0.5%CVE-2026-40894MEDIUMOpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headersEPSS 0.5%CVE-2025-30211HIGHKEX init error results with excessive memory usageEPSS 0.5%CVE-2026-40303HIGHzrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsingEPSS 0.5%CVE-2026-39312HIGHPre-Auth EAP-TLS DoS on SoftEther VPN Developer EditionEPSS 0.4%CVE-2025-32386MEDIUMHelm Allows A Specially Crafted Chart Archive To Cause Out Of Memory TerminationEPSS 0.4%CVE-2026-9538HIGHArchive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar headerEPSS 0.4%CVE-2026-94626HIGHvLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_sizeEPSS 0.4%CVE-2026-54448MEDIUMTrivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parserEPSS 0.4%CVE-2026-75935HIGHMemory-amplification denial of service via declared-length preallocation in Amazon ion-javaEPSS 0.4%