Falhas do tipo CWE-789
336 resultadosAlocação descontrolada de memória
Ocorre quando uma aplicação aloca memória em quantidade determinada por entrada do usuário sem validação ou limite. Um atacante fornece valores muito grandes, causando consumo excessivo de RAM, negação de serviço ou travamento do sistema.
Exemplo
Uma API aceita um parâmetro 'tamanho_array' e aloca memória diretamente: malloc(tamanho_array * sizeof(int)). Se o atacante enviar tamanho_array = 2 bilhões, a alocação falha ou consome toda a memória disponível, derrubando o serviço.
Como mitigar
Implemente limites máximos hardcoded para alocações baseadas em entrada externa. Valide e sanitize parâmetros de tamanho antes de usar, rejeitando valores acima de um threshold sensato. Monitore consumo de memória por requisição e implemente rate limiting.
CVE-2026-25899HIGHFiber is Vulnerable to Denial of Service via Flash Cookie Unbounded AllocationEPSS 0.4%CVE-2025-71395HIGHSurrealDB before 2.2.2 Memory Exhaustion via string::replaceEPSS 0.4%CVE-2025-12983LOWMemory Allocation with Excessive Size Value in GitLabEPSS 0.4%CVE-2026-58067HIGHA vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service.EPSS 0.4%CVE-2026-54448MEDIUMTrivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parserEPSS 0.4%CVE-2026-102509HIGHApache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parserEPSS 0.4%CVE-2026-42582HIGHNetty: HTTP/3 QPACK literal unbounded allocationEPSS 0.4%CVE-2026-48502HIGHMessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflowsEPSS 0.4%CVE-2026-63566HIGHDTLS handshake reassembler allocates buffer from unchecked 24-bit lengthEPSS 0.4%CVE-2026-102731HIGHApache Directory LDAP API: Denial of service via excessive memory allocation in BER decodeEPSS 0.4%CVE-2021-34867HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker muEPSS 0.4%CVE-2026-63574HIGHUnbounded allocation from OpenPGP signature and user attribute subpacket lengthsEPSS 0.4%CVE-2024-41761MEDIUMIBM Db2 denial of serviceEPSS 0.4%CVE-2025-54801HIGHFiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in DecoderEPSS 0.4%CVE-2021-34868HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker muEPSS 0.4%CVE-2026-72656MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2026-72639MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of ServiceEPSS 0.4%CVE-2026-96260MEDIUMMattermost server missing request body size limit on plugin routes allows denial of service by an authenticated userEPSS 0.4%CVE-2026-54890HIGHBEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decodingEPSS 0.4%CVE-2026-72645MEDIUMMemory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceEPSS 0.4%