1678
Reference Description
CVE-2006-3791 large key size in game program triggers crash when a resizing function cannot
allocate enough memory
https://www.cve.org/CVERecord?id=CVE-2006-3791
CVE-2004-2589 large Content-Length HTTP header value triggers application crash in instant
messaging application due to failure in memory allocation
https://www.cve.org/CVERecord?id=CVE-2004-2589
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1131 CISQ Quality Measures (2016) - Security 1128 2442
MemberOf 1162 SEI CERT C Coding Standard - Guidelines 08. Memory
Management (MEM)
1154 2458
MemberOf 1179 SEI CERT Perl Coding Standard - Guidelines 01. Input
Validation and Data Sanitization (IDS)
1178 2465
MemberOf 1308 CISQ Quality Measures - Security 1305 2485
MemberOf 1399 Comprehensive Categorization: Memory Safety 1400 2525
Notes
Relationship
This weakness can be closely associated with integer overflows (CWE-190). Integer overflow
attacks would concentrate on providing an extremely large number that triggers an overflow that
causes less memory to be allocated than expected. By providing a large value that does not
trigger an integer overflow, the attacker could still cause excessive amounts of memory to be
allocated.
Applicable Platform
Uncontrolled memory allocation is possible in many languages, such as dynamic array allocation
in perl or initial size parameters in Collections in Java. However, languages like C and C++
where programmers have the power to more directly control memory management will be more
susceptible.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
WASC 35 SOAP Array Abuse
CERT C Secure Coding MEM35-
C
Imprecise Allocate sufficient memory for an object
SEI CERT Perl Coding
Standard
IDS32-
PL
Imprecise Validate any integer that is used as an
array index
OMG ASCSM ASCSMCWE-