Falhas do tipo CWE-789
251 resultadosAlocação descontrolada de memória
Ocorre quando uma aplicação aloca memória em quantidade determinada por entrada do usuário sem validação ou limite. Um atacante fornece valores muito grandes, causando consumo excessivo de RAM, negação de serviço ou travamento do sistema.
Exemplo
Uma API aceita um parâmetro 'tamanho_array' e aloca memória diretamente: malloc(tamanho_array * sizeof(int)). Se o atacante enviar tamanho_array = 2 bilhões, a alocação falha ou consome toda a memória disponível, derrubando o serviço.
Como mitigar
Implemente limites máximos hardcoded para alocações baseadas em entrada externa. Valide e sanitize parâmetros de tamanho antes de usar, rejeitando valores acima de um threshold sensato. Monitore consumo de memória por requisição e implemente rate limiting.
CVE-2025-2518MEDIUMIBM Db2 denial of serviceEPSS 0.3%CVE-2026-72678MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceEPSS 0.3%CVE-2026-33524HIGHZserio: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in DeserializationEPSS 0.3%CVE-2022-22226MEDIUMJunos OS: EX4300-MP, EX4600, QFX5000 Series: In VxLAN scenarios specific packets processed cause a memory leak leading to a PFE crashEPSS 0.3%CVE-2026-42348MEDIUMOpAMP client reads unbounded HTTP response bodiesEPSS 0.3%CVE-2026-59649HIGHOpenPGP user-attribute subpacket length bounded only by JVM max memoryEPSS 0.3%CVE-2026-14682HIGHPossible OOM from unbounded up-front allocation on a definite-length readEPSS 0.3%CVE-2026-12852HIGHMLS wire decoder allocates attacker-declared opaque length before bounds checkEPSS 0.3%CVE-2026-47321HIGHApache MINA: Unbounded Decompression Amplification DoS in Zlib.inflateEPSS 0.3%CVE-2026-28253HIGHMemory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer ConciergeEPSS 0.3%CVE-2026-69702HIGHSnailJob 1.7.0 Denial of Service via FuryUtil.deserialize OOMEPSS 0.3%CVE-2026-40182MEDIUMOpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodiesEPSS 0.3%CVE-2025-2533MEDIUMIBM Db2 for Linux denial of serviceEPSS 0.3%CVE-2026-93307MEDIUMO-RAN-SC SMO OAM VES Collector memory allocationEPSS 0.3%CVE-2026-77354HIGHkin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decodingEPSS 0.3%CVE-2026-20048HIGHCisco NX-OS Software SNMP Denial of Service VulnerabilityEPSS 0.3%CVE-2026-32941MEDIUMSliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard TransportsEPSS 0.3%CVE-2026-72656MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceEPSS 0.3%CVE-2026-72639MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of ServiceEPSS 0.3%CVE-2026-72687MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceEPSS 0.3%