CWE-789

Memory Allocation with Excessive Size Value

Parent: CWE-770 - Allocation of Resources Without Limits or Throttling

The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

153 vulnerabilities with CWE-789
CVE-2026-27204 MEDIUM
Wasmtime <24.0.6/36.0.6/40.0.4/41.0.4/42.0.0 - DoS
CVSS 6.5
CVE-2026-25899 HIGH
GoFiber v3 <3.1.0 - Deserialization
CVSS 7.5
CVE-2026-25985 HIGH
ImageMagick <7.1.2-15/<6.9.13-40 - DoS
CVSS 7.5
CVE-2026-25579 MEDIUM
Navidrome < 0.60.0 - Authenticated Denial of Service via Large Cover Art Size Parameter
CVSS 6.5
CVE-2026-22803 HIGH
SvelteKit 2.49.0-2.49.4 - Denial of Service via Form Remote Function Memory Exhaustion
CVSS 7.5
CVE-2026-22026 HIGH
CryptoLib < 1.4.3 - Denial of Service via Unbounded Memory Allocation in KMC Client
CVSS 7.5
CVE-2026-22188 MEDIUM
Panda3D <= 1.10.16 - Denial of Service via Unbounded Stack Allocation in deploy-stub
CVSS 5.5
CVE-2026-21452 HIGH
MessagePack for Java < 0.9.11 - Denial of Service via EXT32 Payload Length
CVSS 7.5
CVE-2025-54151 MEDIUM
Qsync Central 5.0.0.0-5.0.0.3 - Denial of Service via Uncontrolled Resource Consumption
CVSS 5.5
CVE-2025-54150 MEDIUM
Qsync Central 5.0.0.0-5.0.0.3 - Authenticated Denial of Service via Uncontrolled Resource Consumption
CVSS 5.5
CVE-2025-54149 MEDIUM
Qsync Central 5.0.0.0-5.0.0.3 - Authenticated Denial of Service via Uncontrolled Resource Consumption
CVSS 5.5
CVE-2025-62600 HIGH
eProsima Fast DDS <2.6.11, 2.7.0-2.14.5, 3.0.0-3.2.3, 3.3.0, 3.4.0-3.4.1 - Remote DoS via SPDP Packet Tampering
CVSS 8.6
CVE-2025-62599 HIGH
eProsima Fast DDS < 2.6.11, 2.7.0-2.14.5, 3.0.0-3.2.3, 3.3.0, 3.4.0 - Remote DoS via SPDP Packet Tampering
CVSS 8.6
CVE-2025-2668 MEDIUM
IBM Db2 11.5.0-11.5.9 - Authenticated Denial of Service via Crafted Query
CVSS 6.5
CVE-2025-66199 MEDIUM
OpenSSL 3.3.0-3.3.6 - Denial of Service via TLS 1.3 Certificate Compression
CVSS 5.9
CVE-2025-12983 LOW
GitLab 16.9-18.3.5, 18.4-18.4.3, 18.5-18.5.1 - Authenticated Denial of Service via Nested Markdown Formatting
CVSS 3.5
CVE-2025-2534 MEDIUM
IBM Db2 11.1.0-11.1.4.7, 11.5.0-11.5.9, 12.1.0-12.1.3 - Denial of Service via Specially Crafted Query
CVSS 5.3
CVE-2025-11579 MEDIUM
nwaples/rardecode <= 2.1.1 - Denial of Service via Large RAR Dictionary Size
CVSS 5.3
CVE-2025-61910 HIGH
ION-DTN 4.1.3s - Denial of Service via Malformed BPv7 Extension Block
CVSS 7.5
CVE-2025-61600 HIGH
Stalwart <0.13.3 - Memory Corruption
CVSS 7.5
CVE-2025-8696 HIGH
ISC Stork 1.0.0-2.3.0 - Unauthenticated Denial of Service via Large Data Input
CVSS 7.5
CVE-2025-23331 HIGH
NVIDIA Triton Inference Server < 25.06 - Denial of Service via Invalid Request
CVSS 7.5
CVE-2025-54801 HIGH
Fiber < 2.52.9 - Denial of Service via Large Numeric Key in Form Data
CVSS 7.5
CVE-2025-2533 MEDIUM
IBM Db2 12.1.0-12.1.2 - Denial of Service via Crafted Query
CVSS 5.3
CVE-2025-53893 MEDIUM
filebrowser 2.38.0 - Authenticated Denial of Service via File Read Endpoint
CVSS 6.5
Details
Vulnerabilities 153
Links
MITRE CWE Entry Search this CWE With Exploits