Weaknesses of type CWE-1284

324 results

Validação inadequada da quantidade de dados em entrada

A aplicação não valida corretamente a quantidade, tamanho ou volume de dados que recebe do usuário, permitindo que entradas maiores ou menores que o esperado passem pelo controle. Isso abre espaço para ataques de negação de serviço, estouro de buffer, consumo excessivo de recursos ou processamento de dados malformados.

Example

Um serviço web aceita um parâmetro 'quantidade' para retornar registros, mas não limita o valor máximo. Um atacante envia quantidade=999999999, forçando a aplicação a alocar gigabytes de memória ou executar query que consome toda a CPU, derrubando o serviço para usuários legítimos.

How to mitigate

Implemente validação explícita para toda entrada numérica ou de tamanho: defina limites mínimos e máximos aceitáveis, rejeite silenciosamente o que sair desses intervalos e registre tentativas suspeitas. Use whitelist de valores válidos quando possível.

CVE-2022-25769HIGHImproper regex in htaccess fileEPSS 0.5%CVE-2026-66374HIGHKnot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path.EPSS 0.5%CVE-2026-73194CRITICALDBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparseEPSS 0.5%CVE-2026-1528HIGHundici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the clientEPSS 0.5%CVE-2024-24715MEDIUMWordPress WordPress BookIt Plugin plugin <= 2.4.0 - Price Bypass Vulnerability vulnerabilityEPSS 0.5%CVE-2026-55952HIGHTLS 1.3 server denial of service via malformed ClientHello pre-shared key extensionEPSS 0.5%CVE-2026-9801MEDIUMKeycloak: keycloak: denial of service via malformed ldap password policy responseEPSS 0.5%CVE-2025-14513HIGHImproper Validation of Specified Quantity in Input in GitLabEPSS 0.5%CVE-2022-20445HIGHIn process_service_search_rsp of sdp_discovery.cc, there is a possible out of bounds read due to improper input validation. This could lead EPSS 0.5%CVE-2026-53587HIGHlibgit2 - Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_dataEPSS 0.5%CVE-2023-4439MEDIUMSourceCodester Card Holder Management System Minus Value unknown vulnerabilityEPSS 0.5%CVE-2026-39829HIGHInvoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/sshEPSS 0.5%CVE-2026-69210HIGHHttp4s: WebSocket decoder accepts negative length, causing infinite decode loopEPSS 0.5%CVE-2026-57023HIGHJunos OS: MX with SPC3, SRX Series: A specifically malformed TCP packet causes a flowd crashEPSS 0.5%CVE-2025-10094MEDIUMImproper Validation of Specified Quantity in Input in GitLabEPSS 0.5%CVE-2026-31970HIGHHTSlib BGZF index file reader has a heap buffer overflowEPSS 0.5%CVE-2026-25863HIGHConditional Fields for Contact Form 7 < 2.7.3 DoS via Uncontrolled Resource ConsumptionEPSS 0.5%CVE-2026-12059HIGHCellopoint｜CelloOS - Improper Access ControlEPSS 0.4%CVE-2022-25727CRITICALMemory Corruption in modem due to improper length check while copying into memory in Snapdragon Consumer IOT, Snapdragon Industrial IOT, SnaEPSS 0.4%CVE-2026-33349MEDIUMfast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy EvaluationEPSS 0.4%