← Back
CWE-789

183 CVEs • Abstraction: Variant

Memory Allocation with Excessive Size Value

The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

JSON object

Loading...

CVEs (183)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-12541
1Eclipse
1Vert.x
Nov 21, 2024
Oct 10, 2018
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the handshake, holding the entire request body in memory. There should be a reasonnab...Show more
In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the handshake, holding the entire request body in memory. There should be a reasonnable limit (8192 bytes) above which the WebSocket gets an HTTP response with the 413 status code and the connection gets closed.Show less
CVE-2017-7652
2Debian
Eclipse
2Debian Linux
Mosquitto
Nov 21, 2024
Apr 25, 2018
N/A· v4
7.5 HIGH· v3
6.0 MEDIUM· v2
In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers the configuration to be reloaded from disk. If there are lots of clients connect...Show more
In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers the configuration to be reloaded from disk. If there are lots of clients connected so that there are no more file descriptors/sockets available (default limit typically 1024 file descriptors on Linux), then opening the configuration file will fail.Show less
CVE-2017-7651
2Debian
Eclipse
2Debian Linux
Mosquitto
Nov 21, 2024
Apr 24, 2018
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of connections with large payload. This can be done without authentications if occur in connection phase o...Show more
In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of connections with large payload. This can be done without authentications if occur in connection phase of MQTT protocol.Show less