Weaknesses of type CWE-1284

387 results

Validação inadequada da quantidade de dados em entrada

A aplicação não valida corretamente a quantidade, tamanho ou volume de dados que recebe do usuário, permitindo que entradas maiores ou menores que o esperado passem pelo controle. Isso abre espaço para ataques de negação de serviço, estouro de buffer, consumo excessivo de recursos ou processamento de dados malformados.

Example

Um serviço web aceita um parâmetro 'quantidade' para retornar registros, mas não limita o valor máximo. Um atacante envia quantidade=999999999, forçando a aplicação a alocar gigabytes de memória ou executar query que consome toda a CPU, derrubando o serviço para usuários legítimos.

How to mitigate

Implemente validação explícita para toda entrada numérica ou de tamanho: defina limites mínimos e máximos aceitáveis, rejeite silenciosamente o que sair desses intervalos e registre tentativas suspeitas. Use whitelist de valores válidos quando possível.

CVE-2026-47667HIGHCImg Library: Uncontrolled Memory Allocation and Memory Leak in `_load_analyze()` via Crafted NIfTI/Analyze HeaderEPSS 0.5%CVE-2026-19873HIGHHTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elementsEPSS 0.5%CVE-2024-47257HIGHFlorent Thiéry has found that selected Axis devices were vulnerable to handling certain ethernet frames which could lead to the Axis device EPSS 0.5%CVE-2022-25769HIGHImproper regex in htaccess fileEPSS 0.5%CVE-2026-115274MEDIUMUnbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in ElixirEPSS 0.5%CVE-2026-109821MEDIUMUnbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in ElixirEPSS 0.5%CVE-2026-73194CRITICALDBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparseEPSS 0.5%CVE-2025-10094MEDIUMImproper Validation of Specified Quantity in Input in GitLabEPSS 0.5%CVE-2026-93345HIGHMikroTik RouterOS < 7.25beta4 Improper Input Validation DoS via BGP Labelled-VPN NLRIEPSS 0.5%CVE-2024-24715MEDIUMWordPress WordPress BookIt Plugin plugin <= 2.4.0 - Price Bypass Vulnerability vulnerabilityEPSS 0.5%CVE-2026-55952HIGHTLS 1.3 server denial of service via malformed ClientHello pre-shared key extensionEPSS 0.5%CVE-2026-31970HIGHHTSlib BGZF index file reader has a heap buffer overflowEPSS 0.5%CVE-2026-9801MEDIUMKeycloak: keycloak: denial of service via malformed ldap password policy responseEPSS 0.5%CVE-2026-48977HIGHOpenSlide: Arbitrary memory write with crafted Ventana BIF fileEPSS 0.5%CVE-2026-53587HIGHlibgit2 - Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_dataEPSS 0.5%CVE-2023-4439MEDIUMSourceCodester Card Holder Management System Minus Value unknown vulnerabilityEPSS 0.5%CVE-2026-33349MEDIUMfast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy EvaluationEPSS 0.5%CVE-2026-76442HIGHCisco Secure Email Gateway Security Hardening ReleaseEPSS 0.5%CVE-2026-39829HIGHInvoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/sshEPSS 0.5%CVE-2026-25345CRITICALWordPress SimpLy Gallery plugin <= 3.3.2 - Arbitrary Code Execution vulnerabilityEPSS 0.5%