Falhas do tipo CWE-789
251 resultadosAlocação descontrolada de memória
Ocorre quando uma aplicação aloca memória em quantidade determinada por entrada do usuário sem validação ou limite. Um atacante fornece valores muito grandes, causando consumo excessivo de RAM, negação de serviço ou travamento do sistema.
Exemplo
Uma API aceita um parâmetro 'tamanho_array' e aloca memória diretamente: malloc(tamanho_array * sizeof(int)). Se o atacante enviar tamanho_array = 2 bilhões, a alocação falha ou consome toda a memória disponível, derrubando o serviço.
Como mitigar
Implemente limites máximos hardcoded para alocações baseadas em entrada externa. Valide e sanitize parâmetros de tamanho antes de usar, rejeitando valores acima de um threshold sensato. Monitore consumo de memória por requisição e implemente rate limiting.
CVE-2025-2668MEDIUMIBM Db2 Denial of ServiceEPSS 0.4%CVE-2024-2494MEDIUMLibvirt: negative g_new0 length can lead to unbounded memory allocationEPSS 0.4%CVE-2026-35633MEDIUMOpenClaw < 2026.3.22 - Unbounded Memory Allocation via Remote Media Error ResponsesEPSS 0.4%CVE-2026-70377HIGHimagecli - Uncontrolled Memory Allocation via Unbounded scale Ratio Causes Denial of ServiceEPSS 0.4%CVE-2025-53893HIGHFile Browser Vulnerable to Uncontrolled Memory Consumption Due to Oversized File ProcessingEPSS 0.4%CVE-2025-61910HIGHNASA ION-DTN BPv7 4.1.3s Uncontrolled Memory Allocation that leads to Denial-of-ServiceEPSS 0.4%CVE-2026-59646HIGHDTLS handshake reassembler allocates buffer from unchecked 24-bit lengthEPSS 0.4%CVE-2026-55768HIGHGoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of serviceEPSS 0.4%CVE-2026-44375HIGHNerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowExceptionEPSS 0.4%CVE-2026-85445HIGHMOOS-IvP through 24.8.1 BHV_IPF Demultiplexer Memory Exhaustion via Packet CountEPSS 0.4%CVE-2026-8485MEDIUMUncontrolled Memory Allocation vulnerability in Progress Software MOVEit AutomationEPSS 0.3%CVE-2026-10142HIGHkafka-python prior to 2.3.2 Denial of Service via Protocol Parser Frame LengthEPSS 0.3%CVE-2026-19566HIGHNet::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengthsEPSS 0.3%CVE-2026-54638HIGHtd has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.DecodeEPSS 0.3%CVE-2026-27204MEDIUMWasmtime WASI implementations are vulnerable to guest-controlled resource exhaustionEPSS 0.3%CVE-2026-81693HIGHopenssl_encrypt before 1.4.9 Denial of Service via QR total fieldEPSS 0.3%CVE-2026-81692HIGHopenssl_encrypt before 1.4.9 Denial of Service via STREAMINFOEPSS 0.3%CVE-2026-5740HIGHUnauthenticated WebSocket binary frame causes denial of service in Mattermost ServerEPSS 0.3%CVE-2026-41178MEDIUMOpenTelemetry-Go's baggage parsing no longer caps raw header lengthEPSS 0.3%CVE-2025-29491MEDIUMAn allocation-size-too-big error in the parseSWF_DEFINEBINARYDATA function of libming v0.48 allows attackers to cause a Denial of Service (DEPSS 0.3%