Falhas do tipo CWE-789
251 resultadosAlocação descontrolada de memória
Ocorre quando uma aplicação aloca memória em quantidade determinada por entrada do usuário sem validação ou limite. Um atacante fornece valores muito grandes, causando consumo excessivo de RAM, negação de serviço ou travamento do sistema.
Exemplo
Uma API aceita um parâmetro 'tamanho_array' e aloca memória diretamente: malloc(tamanho_array * sizeof(int)). Se o atacante enviar tamanho_array = 2 bilhões, a alocação falha ou consome toda a memória disponível, derrubando o serviço.
Como mitigar
Implemente limites máximos hardcoded para alocações baseadas em entrada externa. Valide e sanitize parâmetros de tamanho antes de usar, rejeitando valores acima de um threshold sensato. Monitore consumo de memória por requisição e implemente rate limiting.
CVE-2025-8696HIGHDoS attack against the Stork UI from an unauthenticated userEPSS 0.4%CVE-2026-42582HIGHNetty: HTTP/3 QPACK literal unbounded allocationEPSS 0.4%CVE-2026-48502HIGHMessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflowsEPSS 0.4%CVE-2025-62600HIGHeprosima Fast DDS affected by Out-of-Memory in readBinaryPropertySeq via Manipulated DATA Submessage when DDS Security is enabledEPSS 0.4%CVE-2021-34867HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker muEPSS 0.4%CVE-2026-66273HIGHApache Qpid Proton-J: Type size/count handling can lead to excessive allocation pre-authenticationEPSS 0.4%CVE-2026-47667HIGHCImg Library: Uncontrolled Memory Allocation and Memory Leak in `_load_analyze()` via Crafted NIfTI/Analyze HeaderEPSS 0.4%CVE-2024-41761MEDIUMIBM Db2 denial of serviceEPSS 0.4%CVE-2021-34868HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker muEPSS 0.4%CVE-2026-69219HIGHRabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocationEPSS 0.4%CVE-2026-55379HIGHPillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loadingEPSS 0.4%CVE-2026-54890HIGHBEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decodingEPSS 0.4%CVE-2025-12983LOWMemory Allocation with Excessive Size Value in GitLabEPSS 0.4%CVE-2021-34869HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker muEPSS 0.4%CVE-2026-54060HIGHPillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`EPSS 0.4%CVE-2025-66199MEDIUMTLS 1.3 CompressedCertificate excessive memory allocationEPSS 0.4%CVE-2026-55380HIGHPillow GdImageFile decompression bomb protection bypassEPSS 0.4%CVE-2026-46603HIGHExcessive memory allocation during VP8L decoding in golang.org/x/imageEPSS 0.4%CVE-2026-91752HIGHGNU libextractor before 1.15 Stack Overflow via OLE2EPSS 0.4%CVE-2026-44630HIGHApache IoTDB: RPC service denial of service via unchecked Thrift string lengthEPSS 0.4%