Weaknesses of type CWE-1284

325 results

Validação inadequada da quantidade de dados em entrada

A aplicação não valida corretamente a quantidade, tamanho ou volume de dados que recebe do usuário, permitindo que entradas maiores ou menores que o esperado passem pelo controle. Isso abre espaço para ataques de negação de serviço, estouro de buffer, consumo excessivo de recursos ou processamento de dados malformados.

Example

Um serviço web aceita um parâmetro 'quantidade' para retornar registros, mas não limita o valor máximo. Um atacante envia quantidade=999999999, forçando a aplicação a alocar gigabytes de memória ou executar query que consome toda a CPU, derrubando o serviço para usuários legítimos.

How to mitigate

Implemente validação explícita para toda entrada numérica ou de tamanho: defina limites mínimos e máximos aceitáveis, rejeite silenciosamente o que sair desses intervalos e registre tentativas suspeitas. Use whitelist de valores válidos quando possível.

CVE-2026-2597HIGHCrypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes()EPSS 0.3%CVE-2026-41677LOWrust-openssl: Out-of-bounds read in PEM password callback when user callback returns an oversized lengthEPSS 0.3%CVE-2025-36407MEDIUMIBM Db2 Denial of ServiceEPSS 0.3%CVE-2025-43881MEDIUMImproper validation of specified quantity in input issue exists in Real-time Bus Tracking System versions prior to 1.1. If exploited, a deniEPSS 0.3%CVE-2026-81779CRITICALWordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerabilityEPSS 0.3%CVE-2025-58835MEDIUMWordPress Bonus for Woo plugin <= 7.6.6 - Other vulnerability Type vulnerabilityEPSS 0.3%CVE-2025-13507HIGHTime-series operations may cause internal BSON size limit to be exceedEPSS 0.3%CVE-2025-36015MEDIUMIBM Controller Denial of ServiceEPSS 0.3%CVE-2026-32665HIGHRemote DNS-over-QUIC denial of service due to `quic-size` budget bypassEPSS 0.3%CVE-2025-67901MEDIUMopenrsync through 0.5.0, as used in OpenBSD through 7.8 and on other platforms, allows a client to cause a server SIGSEGV by specifying a leEPSS 0.3%CVE-2026-71394MEDIUMHeap Use of Uninitialized Memory in GNU Emacs for AndroidEPSS 0.3%CVE-2026-70378HIGHimagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable PanicEPSS 0.3%CVE-2026-26934MEDIUMImproper Validation of Specified Quantity in Input in Kibana Leading to Denial of ServiceEPSS 0.3%CVE-2026-20313HIGHCisco Catalyst SD-WAN Security Hardening Release - Memory Corruption VulnerabilitiesEPSS 0.3%CVE-2023-36839MEDIUMJunos OS and Junos OS Evolved: An l2cpd crash will occur when specific LLDP packets are receivedEPSS 0.3%CVE-2026-26940MEDIUMImproper Validation of Specified Quantity in Input in Kibana Leading to Denial of ServiceEPSS 0.3%CVE-2026-57019HIGHJunos OS: MX Series: Specific traffic causes an FPC to resetEPSS 0.3%CVE-2025-25178HIGHGPU DDK - PhysmemWrapExtMem uiSize=0 corrupts kernel memoryEPSS 0.3%CVE-2025-10933MEDIUMSilicon Labs Z-Wave Protocol Controller Integer underflow vulnerability leads to out of bounds readEPSS 0.3%CVE-2024-30516HIGHWordPress Booking Package plugin <= 1.6.27 - Price Manipulation vulnerabilityEPSS 0.3%