Weaknesses of type CWE-1284

324 results

Validação inadequada da quantidade de dados em entrada

A aplicação não valida corretamente a quantidade, tamanho ou volume de dados que recebe do usuário, permitindo que entradas maiores ou menores que o esperado passem pelo controle. Isso abre espaço para ataques de negação de serviço, estouro de buffer, consumo excessivo de recursos ou processamento de dados malformados.

Example

Um serviço web aceita um parâmetro 'quantidade' para retornar registros, mas não limita o valor máximo. Um atacante envia quantidade=999999999, forçando a aplicação a alocar gigabytes de memória ou executar query que consome toda a CPU, derrubando o serviço para usuários legítimos.

How to mitigate

Implemente validação explícita para toda entrada numérica ou de tamanho: defina limites mínimos e máximos aceitáveis, rejeite silenciosamente o que sair desses intervalos e registre tentativas suspeitas. Use whitelist de valores válidos quando possível.

CVE-2024-8887CRITICALAuthentication bypass vulnerability on CIRCUTOR Q-SMTEPSS 0.6%CVE-2023-25731HIGHDue to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwriteEPSS 0.6%CVE-2026-29062HIGHjackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource ExhaustionEPSS 0.6%CVE-2026-1092HIGHImproper Validation of Specified Quantity in Input in GitLabEPSS 0.6%CVE-2025-43972MEDIUMAn issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer EPSS 0.5%CVE-2026-54092MEDIUMFile Browser: DoS Vulnerability on Public Login APIEPSS 0.5%CVE-2024-52901MEDIUMIBM InfoSphere Information Server denial of serviceEPSS 0.5%CVE-2023-54337MEDIUMSysax Multi Server 6.95 - 'Password' Denial of Service (PoC)EPSS 0.5%CVE-2026-59879HIGHImmutable.js `List` 32-bit trie overflow → unrecoverable DoSEPSS 0.5%CVE-2022-2845HIGHImproper Validation of Specified Quantity in Input in vim/vimEPSS 0.5%CVE-2026-57623CRITICALWordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerabilityEPSS 0.5%CVE-2026-59694HIGHUnbounded access list in mpp Tempo fee-payer inflates gas cost per paymentEPSS 0.5%CVE-2026-59695HIGHUnbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drainEPSS 0.5%CVE-2025-70071MEDIUMAn issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXParser.cpp, ParseVectorDataArray()EPSS 0.5%CVE-2026-8813HIGHThis affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled recEPSS 0.5%CVE-2024-30527HIGHWordPress WP Express Checkout plugin <= 2.3.7 - Price Manipulation vulnerabilityEPSS 0.5%CVE-2026-19873HIGHHTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elementsEPSS 0.5%CVE-2024-47257HIGHFlorent Thiéry has found that selected Axis devices were vulnerable to handling certain ethernet frames which could lead to the Axis device EPSS 0.5%CVE-2026-75897HIGHUncontrolled Resource Consumption in Capabilities Route in OpenSearch DashboardsEPSS 0.5%CVE-2025-2256HIGHImproper Validation of Specified Quantity in Input in GitLabEPSS 0.5%