CWE-789: Memory Allocation with Excessive Size Value

The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Consequences

• Availability: DoS: Resource Consumption (Memory)

How to prevent it

• Implementation, Architecture and Design: Perform adequate input validation against any value that influences the amount of memory that is allocated. Define an appropriate strategy for handling requests that exceed the limit, and consider supporting a configuration option so that the administrator can extend the amount of memory to be used if necessary.
• Operation: Run your program using system-provided resource limits for memory. This might still cause the program to crash or exit, but the impact to the rest of the system will be minimized.

Recent advisories

• GHSA-q7v9-x93c-xqv3 — zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction
• GHSA-9hj8-73fh-9963 — zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size
• GHSA-j2w7-387v-m2rq — PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
• GHSA-6wmf-3r64-vcwv — Crass : Large numeric exponents cause CPU and memory denial of service
• GHSA-5xm2-6676-qcp9 — Pillow: APNG background disposal allocates full canvas before decompression bomb check
• EEF-CVE-2026-97853 — Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS
• GHSA-wf3x-273g-mvxv — devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated
• GHSA-r9w8-h9r3-54w4 — devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation
• PYSEC-2026-4008 — vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate…
• GHSA-2p48-j3qc-rx9f — rclone: S3 multipart declared-length memory exhaustion
• PYSEC-2026-3798 — openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges.
• GHSA-hxcr-hm88-mpq6 — Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
• GHSA-vjc4-5qp5-m44j — Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
• GHSA-5qjq-93h5-hrgp — pypdf: Possible large memory usage for wrong image dimensions
• GHSA-f962-qm93-mj4c — Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service

All advisories for CWE-789