CWE-789 未经控制的内存分配 类弱点 241 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-789 属于内存分配漏洞，指程序基于不可信的大数值分配内存，却未验证其是否在预期范围内。攻击者通常利用此缺陷提交超大尺寸值，导致系统分配过量内存，进而引发拒绝服务或内存耗尽。开发者应避免此类风险，在分配内存前严格校验输入参数，确保其处于合理且安全的阈值范围内，从而防止资源被恶意滥用。
unsigned int size = GetUntrustedInt(); /* ignore integer overflow (CWE-190) for this example */ unsigned int totBytes = size * sizeof(char); char *string = (char *)malloc(totBytes); InitializeString(string);unsigned int size = GetUntrustedInt(); HashMap list = new HashMap(size);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-44967 | OpenTelemetry C++ 资源管理错误漏洞 — opentelemetry-cpp | 5.3 | Medium | 2026-06-12 |
| CVE-2026-10142 | kafka-python 安全漏洞 — kafka-python | 7.5 | High | 2026-06-10 |
| CVE-2026-52759 | NSA Ghidra 安全漏洞 — Ghidra | 5.5 | Medium | 2026-06-10 |
| CVE-2026-52753 | National Security Agency Ghidra 安全漏洞 — ghidra | 5.5 | Medium | 2026-06-10 |
| CVE-2026-49975 | Apache HTTP Server 安全漏洞 — Apache HTTP Server | - | - | 2026-06-08 |
| CVE-2026-41178 | OpenTelemetry-Go 安全漏洞 — go.opentelemetry.io/otel/baggage | 5.3 | Medium | 2026-06-04 |
| CVE-2026-47319 | SAMSUNG rLottie 安全漏洞 — rlottie | 6.1 | Medium | 2026-06-04 |
| CVE-2026-9538 | archive-tar-new 安全漏洞 — Archive::Tar | - | - | 2026-05-26 |
| CVE-2018-25378 | StokedOnIt Notebook Pro 安全漏洞 — Notebook Pro | 6.2 | Medium | 2026-05-25 |
| CVE-2018-25368 | Nord VPN 安全漏洞 — NordVPN | 7.5 | High | 2026-05-25 |
| CVE-2026-5740 | Mattermost 安全漏洞 — Mattermost | 7.5 | High | 2026-05-22 |
| CVE-2026-8485 | Progress Software MOVEit 安全漏洞 — MOVEit Automation | 5.9 | Medium | 2026-05-20 |
| CVE-2026-47313 | SAMSUNG Escargot 安全漏洞 — Escargot | 5.5 | Medium | 2026-05-19 |
| CVE-2026-6340 | Mattermost 安全漏洞 — Mattermost | 4.3 | Medium | 2026-05-18 |
| CVE-2021-47973 | WordPress plugin Sticky Notes Widget 安全漏洞 — Sticky Notes Widget | 7.5 | High | 2026-05-16 |
| CVE-2021-47972 | WordPress plugin Sticky Notes Color Widgets 安全漏洞 — Sticky Notes Color Widgets | 7.5 | High | 2026-05-16 |
| CVE-2021-47971 | My Notes Safe 安全漏洞 — My Notes Safe | 7.5 | High | 2026-05-16 |
| CVE-2021-47970 | Macaron Notes 安全漏洞 — Macaron Notes | 7.5 | High | 2026-05-16 |
| CVE-2021-47969 | Social & Mobile Color Notes 安全漏洞 — Color Notes | 7.5 | High | 2026-05-16 |
| CVE-2026-44375 | Nerdbank.MessagePack 安全漏洞 — Nerdbank.MessagePack | 7.5 | High | 2026-05-14 |
| CVE-2026-42946 | F5 NGINX Plus和F5 NGINX Open Source 安全漏洞 — NGINX Plus | 6.5 | Medium | 2026-05-13 |
| CVE-2026-42348 | OpenTelemetry .NET Contrib 安全漏洞 — opentelemetry-dotnet-contrib | 5.9 | Medium | 2026-05-12 |
| CVE-2021-47944 | memono Notepad 安全漏洞 — Notepad | 7.5 | High | 2026-05-10 |
| CVE-2026-42241 | ParquetSharp 安全漏洞 — ParquetSharp | 5.3 | Medium | 2026-05-07 |
| CVE-2026-43868 | Apache Thrift 安全漏洞 — Apache Thrift | 9.1 | - | 2026-05-05 |
| CVE-2026-42146 | CImg 安全漏洞 — CImg | 5.5 | Medium | 2026-05-04 |
| CVE-2026-42440 | Apache OpenNLP 安全漏洞 — Apache OpenNLP | 7.5 | - | 2026-05-04 |
| CVE-2018-25295 | Ambient ObserverIP Scan Tool 安全漏洞 — ObserverIP Scan Tool | 6.2 | Medium | 2026-04-26 |
| CVE-2018-25279 | jiNa OCR Image to Text 安全漏洞 — jiNa OCR Image to Text | 6.2 | Medium | 2026-04-26 |
| CVE-2018-25274 | InfraRecorder 安全漏洞 — InfraRecorder | 6.2 | Medium | 2026-04-26 |
CWE-789（未经控制的内存分配） 是常见的弱点类别，本平台收录该类弱点关联的 241 条 CVE 漏洞。