Weaknesses of type CWE-1284

325 results

Validação inadequada da quantidade de dados em entrada

A aplicação não valida corretamente a quantidade, tamanho ou volume de dados que recebe do usuário, permitindo que entradas maiores ou menores que o esperado passem pelo controle. Isso abre espaço para ataques de negação de serviço, estouro de buffer, consumo excessivo de recursos ou processamento de dados malformados.

Example

Um serviço web aceita um parâmetro 'quantidade' para retornar registros, mas não limita o valor máximo. Um atacante envia quantidade=999999999, forçando a aplicação a alocar gigabytes de memória ou executar query que consome toda a CPU, derrubando o serviço para usuários legítimos.

How to mitigate

Implemente validação explícita para toda entrada numérica ou de tamanho: defina limites mínimos e máximos aceitáveis, rejeite silenciosamente o que sair desses intervalos e registre tentativas suspeitas. Use whitelist de valores válidos quando possível.

CVE-2025-36094MEDIUMMultiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for January 2026.EPSS 0.2%CVE-2026-27171LOWzlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that EPSS 0.2%CVE-2026-79376HIGHAn issue in the l2cap_handle_data() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers tEPSS 0.2%CVE-2024-5102HIGHElevation of Privelage via symlinked file in Avast AntivirusEPSS 0.2%CVE-2026-35489HIGHTandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/`EPSS 0.2%CVE-2026-77640LOWtor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reacEPSS 0.2%CVE-2025-14688MEDIUMIBM® Db2® is vulnerable to a denial of service when fetching from certain tables under specific configurationsEPSS 0.2%CVE-2022-20493HIGHIn Condition of Condition.java, there is a possible way to grant notification access due to improper input validation. This could lead to loEPSS 0.2%CVE-2026-19639MEDIUMImproper Access ControlEPSS 0.2%CVE-2025-46656LOWpython-markdownify (aka markdownify) before 0.14.1 allows large headline prefixes such as <h9999999> in addition to <h1> through <h6>. This EPSS 0.2%CVE-2026-42657MEDIUMWordPress Contest Gallery plugin <= 28.1.7 - Other Vulnerability Type vulnerabilityEPSS 0.2%CVE-2026-33471CRITICALnimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncationEPSS 0.2%CVE-2026-44459LOWHono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()EPSS 0.2%CVE-2024-55407HIGHAn issue in the DeviceloControl function of ITE Tech. Inc ITE IO Access v1.0.0.0 allows attackers to perform arbitrary port read and write aEPSS 0.2%CVE-2026-44826HIGHVvveb: Vvveb CMS — Negative-quantity cart manipulation allows creation of orders with negative grand totalsEPSS 0.2%CVE-2026-53689HIGHlibnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS serEPSS 0.2%CVE-2025-15645MEDIUMLedger Nano X, Flex, Stax MCU Firmware Update Denial of ServiceEPSS 0.2%CVE-2026-41285MEDIUMIn OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (EPSS 0.2%CVE-2024-56716MEDIUMnetdevsim: prevent bad user input in nsim_dev_health_break_write()EPSS 0.2%CVE-2026-42744MEDIUMWordPress Ads by WPQuads plugin <= 3.0.2 - Bypass Vulnerability vulnerabilityEPSS 0.2%