CWE-789 · 242 records

Memory Allocation with Excessive Size Value

CVEs in this class

244 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
57Plan	CVE-2022-30522No exploit	mod_sed denial of serviceapache · http server · CWE-789 Pre-auth Denial of service	High7.5	—	89.5%	Jun 9, 2022
57Plan	CVE-2024-2653No exploit	amphp/http will collect CONTINUATION frames in an unbounded buffer and will not check a limit until it has received the set END_HEADERS flagamphp · amphp/http-client · CWE-789 Pre-auth	High8.2	—	83.3%	Apr 3, 2024
40Plan	CVE-2026-49975Proof of concept	Apache HTTP Server: mod_http2 denial of serviceapache · http server · CWE-789 Pre-auth Denial of service	High7.5	—	32.9%	Jun 8, 2026
39Monitor	CVE-2023-43632No exploit	Freely Allocate Buffer on The Stack With Data From Socketlinuxfoundation · edge virtualization engine · CWE-789	Critical9.9	—	0.6%	Sep 21, 2023
39Monitor	CVE-2026-82435No exploit	Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoderapache software foundation · apache storm worker · CWE-789 Pre-auth	Critical9.8	—	0.6%	Sep 14, 2026
39Monitor	GHSA-xhj4-g6w8-2xjwNo exploit	go-zserio has Unbounded Memory Allocation for All PlatformsGo · github.com/woven-planet/go-zserio · CWE-789 Pre-auth Deserialization	Critical9.8	—	—	Apr 24, 2026
35Monitor	CVE-2026-77410No exploit	RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocationrabbitmq · amqp091-go · CWE-789 Pre-auth	High8.9	—	0.5%	Sep 16, 2026
35Monitor	CVE-2021-34868No exploit	This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160.parallels · parallels · CWE-789 RCE Local privilege escalation	High8.8	—	0.4%	Jan 25, 2022
35Monitor	CVE-2021-34869No exploit	This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160.parallels · parallels · CWE-789 RCE Local privilege escalation	High8.8	—	0.4%	Jan 25, 2022
35Monitor	CVE-2026-61845No exploit	Crass: Large numeric exponents cause CPU and memory denial of servicergrove · crass · CWE-789 Pre-auth	High8.9	—	—	Today
34Monitor	CVE-2020-24685No exploit	AC500 V2 unauthenticated crafter packet vulnerabilityabb · ac500 cpu firmware · CWE-789 Pre-auth Denial of service	High8.6	—	1.6%	Feb 9, 2021
34Monitor	CVE-2026-66733No exploit	Sonic 3 A.I.R. Unbounded Memory Allocation DoS via ReceivedPacketCacheeukaryot · sonic3air · CWE-789 Pre-auth	High8.7	—	1.5%	Aug 6, 2026
34Monitor	CVE-2026-65315No exploit	Ollama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata Parserollama · ollama · CWE-789 Pre-auth	High8.7	—	0.8%	Jul 21, 2026
34Monitor	CVE-2026-85445No exploit	MOOS-IvP through 24.8.1 BHV_IPF Demultiplexer Memory Exhaustion via Packet Countmit · moos-ivp · CWE-789 Pre-auth	High8.7	—	0.7%	Sep 3, 2026
34Monitor	CVE-2026-85442No exploit	MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Unbounded Packet Allocationthemoos · core-moos · CWE-789 Pre-auth	High8.7	—	0.7%	Sep 3, 2026
34Monitor	CVE-2026-91752No exploit	GNU libextractor before 1.15 Stack Overflow via OLE2gnu · libextractor · CWE-789 Pre-auth	High8.7	—	0.7%	Sep 14, 2026
34Monitor	CVE-2026-69219No exploit	RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocationrabbitmq · rabbitmq-java-client · CWE-789 Pre-auth	High8.7	—	0.7%	Aug 18, 2026
34Monitor	CVE-2026-94626No exploit	vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_sizevllm · vllm · CWE-789 Pre-auth	High8.7	—	0.6%	Sep 21, 2026
34Monitor	CVE-2026-59646No exploit	DTLS handshake reassembler allocates buffer from unchecked 24-bit lengthbouncycastle · bc-java · CWE-789 Pre-auth	High8.7	—	0.6%	Aug 2, 2026
34Monitor	CVE-2026-58060No exploit	HSS public-key level count unbounded, enabling huge allocation on verifybouncycastle · bc-java · CWE-789 Pre-auth	High8.7	—	0.6%	Aug 2, 2026
34Monitor	CVE-2026-75935No exploit	Memory-amplification denial of service via declared-length preallocation in Amazon ion-javaamazon ion · amazon ion java · CWE-789 Pre-auth	High8.7	—	0.6%	Aug 18, 2026
34Monitor	CVE-2024-20260No exploit	Cisco Adaptive Security Virtual Appliance and Secure Firewall Threat Defense Virtual SSL VPN Denial of Service Vulnerabilitycisco · cisco secure firewall adaptive security appliance (asa) software · CWE-789 Pre-auth Denial of service	High8.6	—	0.5%	Oct 23, 2024
34Monitor	CVE-2026-111279No exploit	Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBERdragonflydb · dragonfly · CWE-789 Pre-auth	High8.7	—	0.5%	Oct 15, 2026
34Monitor	CVE-2026-20295No exploit	Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software sftunnel Memory Exhaustion Denial of Service Vulnerabilitycisco · cisco secure firewall management center (fmc) · CWE-789 Pre-auth Denial of service	High8.6	—	0.5%	Sep 16, 2026
34Monitor	CVE-2020-37280No exploit	cbor-sync through 1.0.4 Memory Exhaustion via Unchecked CBOR Array Lengthspelioniot · cbor-sync · CWE-789 Pre-auth	High8.7	—	0.5%	Oct 12, 2026

CVE-2022-30522
57Plan
mod_sed denial of service
HighCVSS 7.5No exploitEPSS 89%
- Pre-auth
- Denial of service
apache · http serverJun 9, 2022
CVE-2024-2653
57Plan
amphp/http will collect CONTINUATION frames in an unbounded buffer and will not check a limit until it has received the set END_HEADERS flag
HighCVSS 8.2No exploitEPSS 83%
- Pre-auth
amphp · amphp/http-clientApr 3, 2024
CVE-2026-49975
40Plan
Apache HTTP Server: mod_http2 denial of service
HighCVSS 7.5Proof of conceptEPSS 32%
- Pre-auth
- Denial of service
apache · http serverJun 8, 2026
CVE-2023-43632
39Monitor
Freely Allocate Buffer on The Stack With Data From Socket
CriticalCVSS 9.9No exploitEPSS 0%
linuxfoundation · edge virtualization engineSep 21, 2023
CVE-2026-82435
39Monitor
Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
apache software foundation · apache storm workerSep 14, 2026
GHSA-xhj4-g6w8-2xjw
39Monitor
go-zserio has Unbounded Memory Allocation for All Platforms
CriticalCVSS 9.8No exploit
- Pre-auth
- Deserialization
Go · github.com/woven-planet/go-zserioApr 24, 2026
CVE-2026-77410
35Monitor
RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
rabbitmq · amqp091-goSep 16, 2026
CVE-2021-34868
35Monitor
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160.
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Local privilege escalation
parallels · parallelsJan 25, 2022
CVE-2021-34869
35Monitor
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160.
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Local privilege escalation
parallels · parallelsJan 25, 2022
CVE-2026-61845
35Monitor
Crass: Large numeric exponents cause CPU and memory denial of service
HighCVSS 8.9No exploit
- Pre-auth
rgrove · crassToday
CVE-2020-24685
34Monitor
AC500 V2 unauthenticated crafter packet vulnerability
HighCVSS 8.6No exploitEPSS 1%
- Pre-auth
- Denial of service
abb · ac500 cpu firmwareFeb 9, 2021
CVE-2026-66733
34Monitor
Sonic 3 A.I.R. Unbounded Memory Allocation DoS via ReceivedPacketCache
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
eukaryot · sonic3airAug 6, 2026
CVE-2026-65315
34Monitor
Ollama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata Parser
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
ollama · ollamaJul 21, 2026
CVE-2026-85445
34Monitor
MOOS-IvP through 24.8.1 BHV_IPF Demultiplexer Memory Exhaustion via Packet Count
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
mit · moos-ivpSep 3, 2026
CVE-2026-85442
34Monitor
MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Unbounded Packet Allocation
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
themoos · core-moosSep 3, 2026
CVE-2026-91752
34Monitor
GNU libextractor before 1.15 Stack Overflow via OLE2
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
gnu · libextractorSep 14, 2026
CVE-2026-69219
34Monitor
RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
rabbitmq · rabbitmq-java-clientAug 18, 2026
CVE-2026-94626
34Monitor
vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
vllm · vllmSep 21, 2026
CVE-2026-59646
34Monitor
DTLS handshake reassembler allocates buffer from unchecked 24-bit length
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
bouncycastle · bc-javaAug 2, 2026
CVE-2026-58060
34Monitor
HSS public-key level count unbounded, enabling huge allocation on verify
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
bouncycastle · bc-javaAug 2, 2026
CVE-2026-75935
34Monitor
Memory-amplification denial of service via declared-length preallocation in Amazon ion-java
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
amazon ion · amazon ion javaAug 18, 2026
CVE-2024-20260
34Monitor
Cisco Adaptive Security Virtual Appliance and Secure Firewall Threat Defense Virtual SSL VPN Denial of Service Vulnerability
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Denial of service
cisco · cisco secure firewall adaptive security appliance (asa) softwareOct 23, 2024
CVE-2026-111279
34Monitor
Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
dragonflydb · dragonflyOct 15, 2026
CVE-2026-20295
34Monitor
Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software sftunnel Memory Exhaustion Denial of Service Vulnerability
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Denial of service
cisco · cisco secure firewall management center (fmc)Sep 16, 2026
CVE-2020-37280
34Monitor
cbor-sync through 1.0.4 Memory Exhaustion via Unchecked CBOR Array Lengths
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
pelioniot · cbor-syncOct 12, 2026

All vulnerability classes