Falhas do tipo CWE-789
202 resultadosAlocação descontrolada de memória
Ocorre quando uma aplicação aloca memória em quantidade determinada por entrada do usuário sem validação ou limite. Um atacante fornece valores muito grandes, causando consumo excessivo de RAM, negação de serviço ou travamento do sistema.
Exemplo
Uma API aceita um parâmetro 'tamanho_array' e aloca memória diretamente: malloc(tamanho_array * sizeof(int)). Se o atacante enviar tamanho_array = 2 bilhões, a alocação falha ou consome toda a memória disponível, derrubando o serviço.
Como mitigar
Implemente limites máximos hardcoded para alocações baseadas em entrada externa. Valide e sanitize parâmetros de tamanho antes de usar, rejeitando valores acima de um threshold sensato. Monitore consumo de memória por requisição e implemente rate limiting.
CVE-2022-31804HIGHCODESYS Gateway server prone to denial of service attack due to excessive memory allocationEPSS 1.0%CVE-2022-36078HIGHSlice Memory Allocation with Excessive Size Value in binaryEPSS 0.9%CVE-2023-20108HIGHA vulnerability in the XCP Authentication Service of the Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&PEPSS 0.9%CVE-2026-42946HIGHNGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerabilityEPSS 0.9%CVE-2023-39203MEDIUMUncontrolled resource consumption in Zoom Team Chat for Zoom Desktop Client for Windows and Zoom VDI Client may allow an unauthenticated useEPSS 0.9%CVE-2023-24201CRITICALRaffle Draw System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at get_ticket.php.EPSS 0.9%CVE-2023-3171HIGHEap-7: heap exhaustion via deserializationEPSS 0.9%CVE-2025-20165HIGHCisco BroadWorks SIP Denial of Service VulnerabilityEPSS 0.8%CVE-2026-40378HIGHWindows Local Security Authority Subsystem Service (LSASS) Denial of Service VulnerabilityEPSS 0.8%CVE-2026-42154HIGHPrometheus: remote read endpoint allows denial of service via crafted snappy payloadEPSS 0.8%CVE-2024-41132MEDIUMSixLabors ImageSharp Allows Excessive Memory Allocation in Gif DecoderEPSS 0.8%CVE-2023-37279HIGHFaktory Web Dashboard can lead to denial of service(DOS) via malicious user inputEPSS 0.8%CVE-2022-4741MEDIUMdocconv XMLToText memory allocationEPSS 0.8%CVE-2024-52791MEDIUMDenial of service through memory exhaustion in Matrix Media RepoEPSS 0.7%CVE-2026-43868MEDIUMApache Thrift: Rust implementation vulnerable to CVE-2020-13949 patternEPSS 0.7%CVE-2024-35116MEDIUMIBM MQ denial of serviceEPSS 0.7%CVE-2023-30837HIGHVyper storage allocator overflowEPSS 0.7%CVE-2024-37168MEDIUM@grpc/grpc-js can allocate memory for incoming messages well above configured limitsEPSS 0.7%CVE-2024-32035MEDIUMMemory Allocation with Excessive Size Value in SixLabors.ImageSharpEPSS 0.6%CVE-2024-20260HIGHCisco Adaptive Security Virtual Appliance and Secure Firewall Threat Defense Virtual SSL VPN Denial of Service VulnerabilityEPSS 0.6%