Falhas do tipo CWE-789

336 resultados

Alocação descontrolada de memória

Ocorre quando uma aplicação aloca memória em quantidade determinada por entrada do usuário sem validação ou limite. Um atacante fornece valores muito grandes, causando consumo excessivo de RAM, negação de serviço ou travamento do sistema.

Exemplo

Uma API aceita um parâmetro 'tamanho_array' e aloca memória diretamente: malloc(tamanho_array * sizeof(int)). Se o atacante enviar tamanho_array = 2 bilhões, a alocação falha ou consome toda a memória disponível, derrubando o serviço.

Como mitigar

Implemente limites máximos hardcoded para alocações baseadas em entrada externa. Valide e sanitize parâmetros de tamanho antes de usar, rejeitando valores acima de um threshold sensato. Monitore consumo de memória por requisição e implemente rate limiting.

CVE-2026-27809MEDIUMpsd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gapsEPSS 0.5%CVE-2026-116787HIGHFreeSWITCH: Pre-authentication process termination in the Event Socket via an unbounded Content-LengthEPSS 0.5%CVE-2023-33953HIGHDenial-of-Service in gRPCEPSS 0.5%CVE-2026-55768HIGHGoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of serviceEPSS 0.5%CVE-2025-30211HIGHKEX init error results with excessive memory usageEPSS 0.5%CVE-2026-72678MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceEPSS 0.5%CVE-2026-84888MEDIUMRightNow-AI OpenFang tool_runner.rs shell_exec memory allocationEPSS 0.5%CVE-2026-84289MEDIUMNousResearch hermes-agent MCP Tool mcp_tool.py list_tools memory allocationEPSS 0.5%CVE-2026-39312HIGHPre-Auth EAP-TLS DoS on SoftEther VPN Developer EditionEPSS 0.5%CVE-2026-93849MEDIUMMattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket framesEPSS 0.5%CVE-2025-32386MEDIUMHelm Allows A Specially Crafted Chart Archive To Cause Out Of Memory TerminationEPSS 0.5%CVE-2026-59646HIGHDTLS handshake reassembler allocates buffer from unchecked 24-bit lengthEPSS 0.5%CVE-2025-66199MEDIUMTLS 1.3 CompressedCertificate excessive memory allocationEPSS 0.5%CVE-2026-115909HIGHzip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During ExtractionEPSS 0.5%CVE-2025-8696HIGHDoS attack against the Stork UI from an unauthenticated userEPSS 0.5%CVE-2026-15053HIGHTanium addressed a denial of service vulnerability in Tanium Server.EPSS 0.5%CVE-2026-40894MEDIUMOpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headersEPSS 0.5%CVE-2026-19204HIGHA client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memoryEPSS 0.5%CVE-2026-106452MEDIUMyawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream headerEPSS 0.5%CVE-2026-40303HIGHzrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsingEPSS 0.5%