Falhas do tipo CWE-789
336 resultadosAlocação descontrolada de memória
Ocorre quando uma aplicação aloca memória em quantidade determinada por entrada do usuário sem validação ou limite. Um atacante fornece valores muito grandes, causando consumo excessivo de RAM, negação de serviço ou travamento do sistema.
Exemplo
Uma API aceita um parâmetro 'tamanho_array' e aloca memória diretamente: malloc(tamanho_array * sizeof(int)). Se o atacante enviar tamanho_array = 2 bilhões, a alocação falha ou consome toda a memória disponível, derrubando o serviço.
Como mitigar
Implemente limites máximos hardcoded para alocações baseadas em entrada externa. Valide e sanitize parâmetros de tamanho antes de usar, rejeitando valores acima de um threshold sensato. Monitore consumo de memória por requisição e implemente rate limiting.
CVE-2026-85715HIGHExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory ExhaustionEPSS 0.6%CVE-2026-77301HIGHadm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)EPSS 0.6%CVE-2026-42440HIGHApache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReaderEPSS 0.6%CVE-2026-21452HIGHMessagePack-Java Vulnerable to Remote Denial of Service via Malicious .msgpack Model File Triggering Unbounded EXT Payload AllocationEPSS 0.6%CVE-2026-56387HIGHApache bRPC: Remote Memory Exhaustion in RTMP AMF ParserEPSS 0.6%CVE-2024-20260HIGHCisco Adaptive Security Virtual Appliance and Secure Firewall Threat Defense Virtual SSL VPN Denial of Service VulnerabilityEPSS 0.6%CVE-2026-111108CRITICALApache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readersEPSS 0.6%CVE-2026-44630HIGHApache IoTDB: RPC service denial of service via unchecked Thrift string lengthEPSS 0.6%CVE-2026-15337MEDIUMPotential denial-of-service vulnerability in check_for_language()EPSS 0.6%CVE-2026-22803HIGHSvelteKit has a memory amplification DoS in Remote Functions binary form deserializerEPSS 0.6%CVE-2026-111279HIGHDragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBEREPSS 0.6%CVE-2026-40006HIGHApache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiverEPSS 0.6%CVE-2026-20295HIGHCisco Secure Firewall Management Center and Secure Firewall Threat Defense Software sftunnel Memory Exhaustion Denial of Service VulnerabilityEPSS 0.6%CVE-2026-59844MEDIUMLibssh: libssh: denial of service via oversized sftp read lengthEPSS 0.6%CVE-2024-35152MEDIUMIBM Db2 denial of serviceEPSS 0.6%CVE-2025-61600HIGHUnbounded Memory Allocation in Stalwart IMAP parserEPSS 0.6%CVE-2026-24030MEDIUMUnbounded memory allocation for DoQ and DoH3EPSS 0.6%CVE-2026-25985HIGHMemory allocation with excessive without limits in the internal SVG decoderEPSS 0.6%CVE-2024-37529MEDIUMIBM Db2 denial of serviceEPSS 0.5%CVE-2026-114349MEDIUMApache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batchesEPSS 0.5%