Weaknesses of type CWE-1284

324 results

Validação inadequada da quantidade de dados em entrada

A aplicação não valida corretamente a quantidade, tamanho ou volume de dados que recebe do usuário, permitindo que entradas maiores ou menores que o esperado passem pelo controle. Isso abre espaço para ataques de negação de serviço, estouro de buffer, consumo excessivo de recursos ou processamento de dados malformados.

Example

Um serviço web aceita um parâmetro 'quantidade' para retornar registros, mas não limita o valor máximo. Um atacante envia quantidade=999999999, forçando a aplicação a alocar gigabytes de memória ou executar query que consome toda a CPU, derrubando o serviço para usuários legítimos.

How to mitigate

Implemente validação explícita para toda entrada numérica ou de tamanho: defina limites mínimos e máximos aceitáveis, rejeite silenciosamente o que sair desses intervalos e registre tentativas suspeitas. Use whitelist de valores válidos quando possível.

CVE-2024-9369HIGHInsufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attacker who had compromised the renderer procEPSS 0.7%CVE-2025-33211HIGHNVIDIA Triton Server for Linux contains a vulnerability where an attacker may cause an improper validation of specified quantity in input. AEPSS 0.7%CVE-2022-39272MEDIUMFlux2 vulnerable to Denial of Service due to Improper use of metav1.DurationEPSS 0.7%CVE-2023-23549LOWDoS via long hostnamesEPSS 0.6%CVE-2025-29784HIGHNamelessMC Has Lack of Length Validation for s Parameter in GET RequestsEPSS 0.6%CVE-2026-50285HIGHPomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE CallbackEPSS 0.6%CVE-2026-58662HIGHApache Thrift: C++ THeaderTransport::readString() info-header length bounds bypassEPSS 0.6%CVE-2026-59252HIGHMissing gas_limit validation in mpp Tempo fee-payer enables wallet drainEPSS 0.6%CVE-2025-32415LOWIn libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploitEPSS 0.6%CVE-2023-42447HIGHblurhash panics on parsing crafted inputsEPSS 0.6%CVE-2022-0596MEDIUMImproper Validation of Specified Quantity in Input in microweber/microweberEPSS 0.6%CVE-2026-54234HIGHvLLM: Remote DoS in vLLM via Invalid Recovered Token ReinjectionEPSS 0.6%CVE-2026-34545HIGHOpenEXR: integer overflow lead to OOB in HTJ2K decoderEPSS 0.6%CVE-2025-2826LOWn affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or more ethernet or LAG interfaces may result in ACL policies not being enforced for ingress packets.EPSS 0.6%CVE-2025-12664HIGHImproper Validation of Specified Quantity in Input in GitLabEPSS 0.6%CVE-2024-24690MEDIUMZoom Clients - Improper Input ValidationEPSS 0.6%CVE-2024-9448HIGHOn affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be droppEPSS 0.6%CVE-2024-7316MEDIUMDenial of Service (DoS) Vulnerability in Mitsubishi Electric CNC SeriesEPSS 0.6%CVE-2025-15080HIGHInformation Disclosure, Information Tampering, and Denial of Service (DoS) Vulnerability in Mitsubishi Electric proprietary protocol communication and SLMP communication for FA productsEPSS 0.6%CVE-2024-8887CRITICALAuthentication bypass vulnerability on CIRCUTOR Q-SMTEPSS 0.6%