Weaknesses of type CWE-1284

387 results

Validação inadequada da quantidade de dados em entrada

A aplicação não valida corretamente a quantidade, tamanho ou volume de dados que recebe do usuário, permitindo que entradas maiores ou menores que o esperado passem pelo controle. Isso abre espaço para ataques de negação de serviço, estouro de buffer, consumo excessivo de recursos ou processamento de dados malformados.

Example

Um serviço web aceita um parâmetro 'quantidade' para retornar registros, mas não limita o valor máximo. Um atacante envia quantidade=999999999, forçando a aplicação a alocar gigabytes de memória ou executar query que consome toda a CPU, derrubando o serviço para usuários legítimos.

How to mitigate

Implemente validação explícita para toda entrada numérica ou de tamanho: defina limites mínimos e máximos aceitáveis, rejeite silenciosamente o que sair desses intervalos e registre tentativas suspeitas. Use whitelist de valores válidos quando possível.

CVE-2026-58662HIGHApache Thrift: C++ THeaderTransport::readString() info-header length bounds bypassEPSS 1.1%CVE-2022-0414MEDIUMImproper Validation of Specified Quantity in Input in dolibarr/dolibarrEPSS 1.0%CVE-2023-34188—The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload overEPSS 1.0%CVE-2026-2229HIGHundici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits ValidationEPSS 1.0%CVE-2023-30082HIGHA denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is suppliedEPSS 1.0%CVE-2022-28613HIGHSpecially Crafted Modbus TCP Packet Vulnerability in RTU500 seriesEPSS 1.0%CVE-2022-0174MEDIUMImproper Validation of Specified Quantity in Input in dolibarr/dolibarrEPSS 1.0%CVE-2022-37312MEDIUMOX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servletEPSS 1.0%CVE-2022-37311MEDIUMOX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect servlet.EPSS 1.0%CVE-2025-3511HIGHImproper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O module, CC-LinEPSS 0.9%CVE-2026-71314HIGHNuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island renderingEPSS 0.9%CVE-2023-42444HIGHphonenumber panics on parsing crafted RF3966 inputsEPSS 0.9%CVE-2023-38744—Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port ofEPSS 0.9%CVE-2026-92386HIGHserver-set cookie aborts cookie jar loadEPSS 0.8%CVE-2022-4111MEDIUMImproper Validation of Specified Quantity in Input in tooljet/tooljetEPSS 0.8%CVE-2022-39313HIGHParse Server crashes when receiving file download request with invalid byte rangeEPSS 0.8%CVE-2026-76763HIGHIo.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literalsEPSS 0.8%CVE-2022-39272MEDIUMFlux2 vulnerable to Denial of Service due to Improper use of metav1.DurationEPSS 0.8%CVE-2022-2277HIGHA vulnerability exists in the ICCP stack of the affected SYS600 versions due to validation flaw in the process that establishes the ICCP communication. The validation flaw will cause a denial-of-service when ICCP of SYS600 is request to forward any da ...EPSS 0.8%CVE-2021-44693MEDIUMAffected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deniEPSS 0.8%