Weaknesses of type CWE-1284

387 results

Validação inadequada da quantidade de dados em entrada

A aplicação não valida corretamente a quantidade, tamanho ou volume de dados que recebe do usuário, permitindo que entradas maiores ou menores que o esperado passem pelo controle. Isso abre espaço para ataques de negação de serviço, estouro de buffer, consumo excessivo de recursos ou processamento de dados malformados.

Example

Um serviço web aceita um parâmetro 'quantidade' para retornar registros, mas não limita o valor máximo. Um atacante envia quantidade=999999999, forçando a aplicação a alocar gigabytes de memória ou executar query que consome toda a CPU, derrubando o serviço para usuários legítimos.

How to mitigate

Implemente validação explícita para toda entrada numérica ou de tamanho: defina limites mínimos e máximos aceitáveis, rejeite silenciosamente o que sair desses intervalos e registre tentativas suspeitas. Use whitelist de valores válidos quando possível.

CVE-2026-94645HIGHApache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop boundEPSS 0.3%CVE-2026-19639MEDIUMImproper Access ControlEPSS 0.3%CVE-2023-52343MEDIUMIn SecurityCommand message after as security has been actived., there is a possible improper input validation. This could lead to remote infEPSS 0.3%CVE-2026-94646HIGHApache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)EPSS 0.3%CVE-2026-41677LOWrust-openssl: Out-of-bounds read in PEM password callback when user callback returns an oversized lengthEPSS 0.3%CVE-2026-123660MEDIUMVulnerability-Lookup: memory amplification through webhook payload template format specifiersEPSS 0.3%CVE-2024-7488MEDIUMBusiness Logic Error in RestApp Inc.'s Online Ordering SystemEPSS 0.3%CVE-2025-58835MEDIUMWordPress Bonus for Woo plugin <= 7.6.6 - Other vulnerability Type vulnerabilityEPSS 0.3%CVE-2026-26940MEDIUMImproper Validation of Specified Quantity in Input in Kibana Leading to Denial of ServiceEPSS 0.3%CVE-2026-32665HIGHRemote DNS-over-QUIC denial of service due to `quic-size` budget bypassEPSS 0.3%CVE-2025-36015MEDIUMIBM Controller Denial of ServiceEPSS 0.3%CVE-2025-67901MEDIUMopenrsync through 0.5.0, as used in OpenBSD through 7.8 and on other platforms, allows a client to cause a server SIGSEGV by specifying a leEPSS 0.3%CVE-2025-14689MEDIUMIBM Db2 Denial of ServiceEPSS 0.3%CVE-2026-94636HIGHApache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used upEPSS 0.3%CVE-2026-91137HIGHApache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elementsEPSS 0.3%CVE-2026-115382MEDIUMWasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoSEPSS 0.3%CVE-2026-102066HIGHJunos OS and Junos OS Evolved: Malformed RSVP packet causes a rpd crash when RSVP is enabledEPSS 0.3%CVE-2025-13867MEDIUMIBM Db2 Denial of ServiceEPSS 0.3%CVE-2025-25178HIGHGPU DDK - PhysmemWrapExtMem uiSize=0 corrupts kernel memoryEPSS 0.3%CVE-2025-36423MEDIUMIBM Db2 Denial of ServiceEPSS 0.3%