Weaknesses of type CWE-789

202 results

Alocação de memória descontrolada

Ocorre quando a aplicação aloca memória de forma proporcional a entrada do usuário sem validar limites, permitindo que um atacante force a alocação de quantidades excessivas de RAM. Isso causa consumo de memória em massa (DoS) ou até crash da aplicação.

Example

Um servidor web que redimensiona um buffer baseado no header Content-Length enviado pelo cliente sem checá-lo contra um máximo razoável. Um atacante envia Content-Length: 999999999, forçando a alocação de gigabytes de memória instantaneamente e derrubando o serviço.

How to mitigate

Defina e enforce limites máximos de memória por operação — valide tamanhos de entrada contra thresholds conhecidos antes de alocar. Use mecanismos do SO (ulimit, cgroups) para restringir memória por processo como última linha de defesa.

CVE-2022-30522—mod_sed denial of serviceEPSS 90.4%CVE-2026-49975HIGHApache HTTP Server: mod_http2 denial of serviceEPSS 28.0%CVE-2025-27533MEDIUMApache ActiveMQ: Unchecked buffer length can cause excessive memory allocationEPSS 8.6%CVE-2017-7651—In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of connections with large EPSS 5.3%CVE-2021-31811—A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny fileEPSS 3.4%CVE-2021-27906—A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the fileEPSS 3.3%CVE-2024-43484HIGH.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityEPSS 2.9%CVE-2023-3223HIGHUndertow: outofmemoryerror due to @multipartconfig handlingEPSS 2.7%CVE-2018-12541—In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the hEPSS 2.7%CVE-2020-8552MEDIUMKubernetes API server denial of serviceEPSS 2.4%CVE-2017-7652—In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers EPSS 1.7%CVE-2020-24685HIGHAC500 V2 unauthenticated crafter packet vulnerabilityEPSS 1.6%CVE-2022-22188HIGHJunos OS: QFX5100/QFX5110/QFX5120/QFX5200/QFX5210/EX4600/EX4650 Series: When storm control profiling is enabled and a device is under an active storm, a Heap-based Buffer Overflow in the PFE will cause a device to hang.EPSS 1.5%CVE-2017-20016MEDIUMWEKA INTEREST Security Scanner Portscan memory allocationEPSS 1.4%CVE-2020-5303LOWDenial of service in TendermintEPSS 1.3%CVE-2022-34917HIGHUnauthenticated clients may cause OutOfMemoryError on Apache Kafka BrokersEPSS 1.3%CVE-2020-3596MEDIUMCisco Expressway Series and TelePresence Video Communication Server Denial of Service VulnerabilityEPSS 1.2%CVE-2026-53917HIGHApache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshallingEPSS 1.2%CVE-2020-8551MEDIUMKubernetes kubelet denial of serviceEPSS 1.1%CVE-2023-6516HIGHSpecific recursive query patterns may lead to an out-of-memory conditionEPSS 1.1%