Skip to content
OpenAdvisories

Weakness (CWE)

CWE-789: Memory Allocation with Excessive Size Value

Variant Draft

The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

How to prevent it (2 mitigations)

  1. Implementation, Architecture and Design

    Perform adequate input validation against any value that influences the amount of memory that is allocated. Define an appropriate strategy for handling requests that exceed the limit, and consider supporting a configuration option so that the administrator can extend the amount of memory to be used if necessary.

  2. Operation

    Run your program using system-provided resource limits for memory. This might still cause the program to crash or exit, but the impact to the rest of the system will be minimized.

Source: MITRE CWE-789

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-49975 Public exploit EPSS 33%

    Apache HTTP Server: mod_http2 denial of service

    Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  • High 7.5
    CVE-2026-42154 Public exploit

    Prometheus: remote read endpoint allows denial of service via crafted snappy payload

    Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An…

    prometheus prometheus prometheus prometheus Debian Ubuntu Alpine Go