Weaknesses of type CWE-1284

387 results

Validação inadequada da quantidade de dados em entrada

A aplicação não valida corretamente a quantidade, tamanho ou volume de dados que recebe do usuário, permitindo que entradas maiores ou menores que o esperado passem pelo controle. Isso abre espaço para ataques de negação de serviço, estouro de buffer, consumo excessivo de recursos ou processamento de dados malformados.

Example

Um serviço web aceita um parâmetro 'quantidade' para retornar registros, mas não limita o valor máximo. Um atacante envia quantidade=999999999, forçando a aplicação a alocar gigabytes de memória ou executar query que consome toda a CPU, derrubando o serviço para usuários legítimos.

How to mitigate

Implemente validação explícita para toda entrada numérica ou de tamanho: defina limites mínimos e máximos aceitáveis, rejeite silenciosamente o que sair desses intervalos e registre tentativas suspeitas. Use whitelist de valores válidos quando possível.

CVE-2023-42447HIGHblurhash panics on parsing crafted inputsEPSS 0.6%CVE-2026-66374HIGHKnot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path.EPSS 0.6%CVE-2022-0596MEDIUMImproper Validation of Specified Quantity in Input in microweber/microweberEPSS 0.6%CVE-2026-54234HIGHvLLM: Remote DoS in vLLM via Invalid Recovered Token ReinjectionEPSS 0.6%CVE-2026-29062HIGHjackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource ExhaustionEPSS 0.6%CVE-2024-9448HIGHOn affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be droppEPSS 0.6%CVE-2025-15080HIGHInformation Disclosure, Information Tampering, and Denial of Service (DoS) Vulnerability in Mitsubishi Electric proprietary protocol communication and SLMP communication for FA productsEPSS 0.6%CVE-2026-46350CRITICALdcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASSEPSS 0.6%CVE-2025-32415LOWIn libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploitEPSS 0.6%CVE-2025-12664HIGHImproper Validation of Specified Quantity in Input in GitLabEPSS 0.6%CVE-2026-70409MEDIUMeldap does not bound the port component of a referral URL before integer conversionEPSS 0.6%CVE-2026-71562MEDIUMhttpc does not bound server-supplied numeric header values before integer conversionEPSS 0.6%CVE-2026-59879HIGHImmutable.js `List` 32-bit trie overflow → unrecoverable DoSEPSS 0.6%CVE-2026-53794MEDIUMrsync < 3.5.0 Denial of Service via --max-alloc=0 Logic ErrorEPSS 0.6%CVE-2024-24690MEDIUMZoom Clients - Improper Input ValidationEPSS 0.6%CVE-2022-20445HIGHIn process_service_search_rsp of sdp_discovery.cc, there is a possible out of bounds read due to improper input validation. This could lead EPSS 0.6%CVE-2024-7316MEDIUMDenial of Service (DoS) Vulnerability in Mitsubishi Electric CNC SeriesEPSS 0.6%CVE-2026-1092HIGHImproper Validation of Specified Quantity in Input in GitLabEPSS 0.6%CVE-2026-1528HIGHundici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the clientEPSS 0.6%CVE-2025-43972MEDIUMAn issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer EPSS 0.6%