Weaknesses of type CWE-1284

324 results

Validação inadequada da quantidade de dados em entrada

A aplicação não valida corretamente a quantidade, tamanho ou volume de dados que recebe do usuário, permitindo que entradas maiores ou menores que o esperado passem pelo controle. Isso abre espaço para ataques de negação de serviço, estouro de buffer, consumo excessivo de recursos ou processamento de dados malformados.

Example

Um serviço web aceita um parâmetro 'quantidade' para retornar registros, mas não limita o valor máximo. Um atacante envia quantidade=999999999, forçando a aplicação a alocar gigabytes de memória ou executar query que consome toda a CPU, derrubando o serviço para usuários legítimos.

How to mitigate

Implemente validação explícita para toda entrada numérica ou de tamanho: defina limites mínimos e máximos aceitáveis, rejeite silenciosamente o que sair desses intervalos e registre tentativas suspeitas. Use whitelist de valores válidos quando possível.

CVE-2025-13078MEDIUMImproper Validation of Specified Quantity in Input in GitLabEPSS 0.4%CVE-2025-70069HIGHAn issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp and ConvertMeshMultiMaterial() metEPSS 0.4%CVE-2025-65548CRITICALNUT-14 allows cashu tokens to be created with a preimage hash. However, nutshell (cashubtc/nuts) before 0.18.0 do not validate the size of pEPSS 0.4%CVE-2025-43964LOWIn LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values.EPSS 0.4%CVE-2021-47821MEDIUMRarmaRadio 2.72.8 - Denial of ServiceEPSS 0.4%CVE-2026-1101MEDIUMImproper Validation of Specified Quantity in Input in GitLabEPSS 0.4%CVE-2026-0925LOWTanium addressed an improper input validation vulnerability in Discover.EPSS 0.4%CVE-2025-43793MEDIUMLiferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA throuEPSS 0.4%CVE-2026-6876CRITICALSandbox Escape in ServiceNow AI PlatformEPSS 0.4%CVE-2026-3676MEDIUMThere are multiple vulnerabilities in IBM DB2 bundled with IBM Application Performance Management products.EPSS 0.4%CVE-2026-71314HIGHNuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island renderingEPSS 0.4%CVE-2022-48298HIGHThe geofencing kernel code does not verify the length of the input data. Successful exploitation of this vulnerability may cause out-of-bounEPSS 0.4%CVE-2022-48297HIGHThe geofencing kernel code has a vulnerability of not verifying the length of the input data. Successful exploitation of this vulnerability EPSS 0.4%CVE-2026-87470CRITICALImproper quantity validation in Tint in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbiEPSS 0.4%CVE-2026-11721HIGHCache poisoning possible with label count discrepancy, RRSIG, and wildcardsEPSS 0.4%CVE-2023-7332HIGHPocketMine-MP < 4.18.1 Improper Validation of Dropped Item Count Allows Remote Server CrashEPSS 0.4%CVE-2026-10822MEDIUMKey Record using PRIVATEDNS algorithm may lead to unexpected exitEPSS 0.4%CVE-2024-27360MEDIUMA vulnerability was discovered in Samsung Mobile Processors Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, ExyEPSS 0.4%CVE-2026-56035HIGHWordPress BitFire Security plugin <= 5.0.3 - Multiple Vulnerabilities vulnerabilityEPSS 0.4%CVE-2021-47831MEDIUMSandboxie 5.49.7 - Denial of ServiceEPSS 0.4%