CWE-789: Stack Exhaustion
The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
Also known as Memory Allocation with Excessive Size Value.
A kind of CWE-770 Allocation of Resources Without Limits or Throttling.
From the CWE List. © The MITRE Corporation.
Newest
- pelioniot cbor-synccbor-sync through 1.0.4 Memory Exhaustion via Unchecked CBOR Array Lengths8.7 High
- zhayujie cowagentzhayujie CowAgent Media Download memory allocation5.3 Medium
- ericmj decimalUnbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS6.9 Medium
- xerial snappy-javaXerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service8.7 High
- borewit music-metadatamusic-metadata: MP4 parser allows memory exhaustion via oversized extended atom length6.2 Medium
- borewit music-metadatamusic-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort6.2 Medium
- borewit music-metadatamusic-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS6.2 Medium
- borewit music-metadatamusic-metadata: Uncontrolled memory allocation in APEv2 parser6.2 Medium
- excelizeExcelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process7.1 High
- excelizeExcelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS7.5 High
- imagemagickImageMagick: Denial of service in ASE decoder because of missing security checks5.3 Medium
- yawkat lz4-javayawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError5.3 Medium
- yawkat lz4-javayawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header5.3 Medium
- elastic elasticsearchMemory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service6.5 Medium
- sixlabors imagesharpImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions5.3 Medium
- djangoproject djangoPotential denial-of-service vulnerability in get_supported_language_variant()6.9 Medium
- docling, docling-project docling-slim +1 moreDocling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion6.5 Medium
- moby buildkitOversized Dockerfile or .dockerignore can exhaust buildkitd memory6.8 Medium
- No product listedAn issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded...7.7 High
- apache software foundation thriftApache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D)8.7 High
- apache software foundation thriftApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Container element count not bounded by the bytes a…8.7 High
- apache software foundation thriftApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a pee…8.7 High
- apache software foundation thriftApache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length8.7 High
- apache software foundation directory ldap apiApache Directory LDAP API: Denial of service via excessive memory allocation in BER decode7.5 High
- bouncycastle bc-csharpUnbounded HSS public key level count allows huge array allocation during signature verification8.7 High
- bouncycastle bc-csharpUnbounded allocation from OpenPGP signature and user attribute subpacket lengths8.7 High
- bouncycastle bc-csharpDTLS handshake reassembler allocates buffer from unchecked 24-bit length8.7 High
- apache http serverApache HTTP Server: mod_dav shared lock overflow4.3 Medium
- tonycoz imagerImager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol7.5 High
- apache software foundation plc4xApache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengths8.7 High
- apache software foundation plc4xApache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parser8.7 High
- eugeny russh, rust pageant +1 morepageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)6.2 Medium
- px4 px4-autopilotPX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Command7.1 High
- apache qpid broker-jApache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoder7.5 High
hiredisDebianhiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in...7.5 High- mattermost, mattermost server +1 moreMattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user6.5 Medium
- emiago sipgoSIPGO: DoS via unvalidated WebSocket frame length7.5 High
- emiago sipgoSIPGO: DoS via unvalidated Content-Length in the stream parser7.5 High
- psd-toolspsd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometry7.5 High
- vectordotdev vectorVector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation.8.7 High
- vllmvLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size8.7 High
- kubeedgeKubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub6.5 Medium
- apache software foundation minaApache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate7.5 High
- sveltejs devaluedevalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers7.5 High
libimager-perlDebian,perl-ImagerMageia +1 moreImager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read9.1 Critical- o-ran-sc smo oamO-RAN-SC SMO OAM VES Collector memory allocation5.3 Medium
- mattiasw exifreaderExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion7.5 High
- cisco secure firewall management center (fmc), secure firewall threat defense (ftd) software +1 moreCisco Secure Firewall Management Center and Secure Firewall Threat Defense Software sftunnel Memory Exhaustion Denial of Service Vulnerability8.6 High
- rabbitmq amqp091-goRabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation8.9 High
- gnu libextractorGNU libextractor before 1.15 Stack Overflow via OLE28.7 High
- Show moreLoading…