Falhas do tipo CWE-789

336 resultados

Alocação descontrolada de memória

Ocorre quando uma aplicação aloca memória em quantidade determinada por entrada do usuário sem validação ou limite. Um atacante fornece valores muito grandes, causando consumo excessivo de RAM, negação de serviço ou travamento do sistema.

Exemplo

Uma API aceita um parâmetro 'tamanho_array' e aloca memória diretamente: malloc(tamanho_array * sizeof(int)). Se o atacante enviar tamanho_array = 2 bilhões, a alocação falha ou consome toda a memória disponível, derrubando o serviço.

Como mitigar

Implemente limites máximos hardcoded para alocações baseadas em entrada externa. Valide e sanitize parâmetros de tamanho antes de usar, rejeitando valores acima de um threshold sensato. Monitore consumo de memória por requisição e implemente rate limiting.

CVE-2026-69702HIGHSnailJob 1.7.0 Denial of Service via FuryUtil.deserialize OOMEPSS 0.5%CVE-2026-24146HIGHNVIDIA Triton Inference Server contains a vulnerability where insufficient input validation and a large number of outputs could cause a servEPSS 0.5%CVE-2020-37280HIGHcbor-sync through 1.0.4 Memory Exhaustion via Unchecked CBOR Array LengthsEPSS 0.5%CVE-2026-93307MEDIUMO-RAN-SC SMO OAM VES Collector memory allocationEPSS 0.5%CVE-2026-112399HIGHPillow: APNG background disposal allocates full canvas before decompression bomb checkEPSS 0.5%CVE-2026-11946HIGHGetEndpoints Memory Exhaustion in open62541EPSS 0.5%CVE-2026-77410HIGHRabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer AllocationEPSS 0.5%CVE-2026-77619HIGHVector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation.EPSS 0.5%CVE-2026-33592HIGHFindServers Memory Exhaustion in open62541EPSS 0.5%CVE-2026-77354HIGHkin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decodingEPSS 0.5%CVE-2026-109149MEDIUMbeautifier js-beautify memory allocationEPSS 0.5%CVE-2026-55379HIGHPillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loadingEPSS 0.5%CVE-2026-103603HIGHUnbounded HSS public key level count allows huge array allocation during signature verificationEPSS 0.5%CVE-2026-116095MEDIUMsmg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocationEPSS 0.5%CVE-2026-55380HIGHPillow GdImageFile decompression bomb protection bypassEPSS 0.5%CVE-2025-62600HIGHeprosima Fast DDS affected by Out-of-Memory in readBinaryPropertySeq via Manipulated DATA Submessage when DDS Security is enabledEPSS 0.5%CVE-2026-9538HIGHArchive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar headerEPSS 0.5%CVE-2026-47667HIGHCImg Library: Uncontrolled Memory Allocation and Memory Leak in `_load_analyze()` via Crafted NIfTI/Analyze HeaderEPSS 0.5%CVE-2026-59991HIGHpsd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometryEPSS 0.5%CVE-2026-59938MEDIUMpypdf: Possible large memory usage for wrong image dimensionsEPSS 0.5%