CWE-789

338 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 7High 169Medium 155Low 6Not scored 1

CVEs per yearBy the year they were published

CVE-2026-123616
imgproxy 3.3.0 before 4.0.16 Memory Exhaustion DoS via ICO Loader
imgproxy · imgproxy
High8.7
CVE-2026-123563
Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse
sveltejs · devalue
High8.7
CVE-2026-116787
FreeSWITCH: Pre-authentication process termination in the Event Socket via an unbounded Content-Length
signalwire · freeswitch
High7.5
CVE-2026-122052
laspy LAS File lasreader.py memory allocation
laspy
Medium5.3
CVE-2026-122129
CESNET ipfixcol2 2.7.1 before 2.9.0 Memory Exhaustion via TCP LZ4 Decoder
CESNET · ipfixcol2
Medium6.9
CVE-2026-103582
Apache ActiveMQ NMS OpenWire Client Library: Unbounded/Unvalidated Length Fields in Apache.NMS.OpenWire Unmarshalling (DoS)
Apache Software Foundation · Apache ActiveMQ NMS OpenWire Client Library
Not scored
CVE-2026-63476
isomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS)
isomorphic-git · isomorphic-git
Medium4.3
CVE-2026-83594
Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names
Apache Software Foundation · Apache Wicket
High8.3
CVE-2026-62297
ag-psd has uncontrolled memory allocation via declared PSD dimensions (DoS)
Agamnentzar · ag-psd
High7.5
CVE-2026-62254
LibreDWG: excessive class-decoding reallocation in R13-R2000 DWG parsing
LibreDWG · libredwg
Medium5.5