Weaknesses of type CWE-1284

387 results

Validação inadequada da quantidade de dados em entrada

A aplicação não valida corretamente a quantidade, tamanho ou volume de dados que recebe do usuário, permitindo que entradas maiores ou menores que o esperado passem pelo controle. Isso abre espaço para ataques de negação de serviço, estouro de buffer, consumo excessivo de recursos ou processamento de dados malformados.

Example

Um serviço web aceita um parâmetro 'quantidade' para retornar registros, mas não limita o valor máximo. Um atacante envia quantidade=999999999, forçando a aplicação a alocar gigabytes de memória ou executar query que consome toda a CPU, derrubando o serviço para usuários legítimos.

How to mitigate

Implemente validação explícita para toda entrada numérica ou de tamanho: defina limites mínimos e máximos aceitáveis, rejeite silenciosamente o que sair desses intervalos e registre tentativas suspeitas. Use whitelist de valores válidos quando possível.

CVE-2024-20149HIGHIn Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional EPSS 0.8%CVE-2022-46143MEDIUMAffected devices do not check the TFTP blocksize correctly. This could allow an authenticated attacker to read from an uninitialized buffer EPSS 0.7%CVE-2022-4171MEDIUMdemon image annotation <= 5.0 - Improper Input Restriction ValidationEPSS 0.7%CVE-2026-50285HIGHPomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE CallbackEPSS 0.7%CVE-2023-30269HIGHCLTPHP <=6.0 is vulnerable to Improper Input Validation via application/admin/controller/Template.php.EPSS 0.7%CVE-2026-75897HIGHUncontrolled Resource Consumption in Capabilities Route in OpenSearch DashboardsEPSS 0.7%CVE-2024-39697HIGHphonenumber panics on parsing crafted phonenumber inputsEPSS 0.7%CVE-2026-59696MEDIUMuri_string does not bound the port component of a URI before integer conversionEPSS 0.7%CVE-2026-70405MEDIUMsnmp BER INTEGER decoder applies no size limit to attacker-supplied integer fieldsEPSS 0.7%CVE-2024-9369HIGHInsufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attacker who had compromised the renderer procEPSS 0.7%CVE-2024-1610HIGHOPPO Store app include remote account token hijacking and sensitive information leakageEPSS 0.7%CVE-2023-4518MEDIUMA vulnerability exists in the input validation of the GOOSE messages where out of range values received and processed by the IED caused a EPSS 0.7%CVE-2025-33211HIGHNVIDIA Triton Server for Linux contains a vulnerability where an attacker may cause an improper validation of specified quantity in input. AEPSS 0.7%CVE-2026-6876CRITICALSandbox Escape in ServiceNow AI PlatformEPSS 0.7%CVE-2025-29784HIGHNamelessMC Has Lack of Length Validation for s Parameter in GET RequestsEPSS 0.7%CVE-2023-23549LOWDoS via long hostnamesEPSS 0.6%CVE-2026-34545HIGHOpenEXR: integer overflow lead to OOB in HTJ2K decoderEPSS 0.6%CVE-2026-19566HIGHNet::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengthsEPSS 0.6%CVE-2026-87962HIGHt-digest 3.1 through 3.3 Denial of Service via Unvalidated Length Fields in MergingDigest.fromBytesEPSS 0.6%CVE-2026-69210HIGHHttp4s: WebSocket decoder accepts negative length, causing infinite decode loopEPSS 0.6%