Weaknesses of type CWE-1284

387 results

Validação inadequada da quantidade de dados em entrada

A aplicação não valida corretamente a quantidade, tamanho ou volume de dados que recebe do usuário, permitindo que entradas maiores ou menores que o esperado passem pelo controle. Isso abre espaço para ataques de negação de serviço, estouro de buffer, consumo excessivo de recursos ou processamento de dados malformados.

Example

Um serviço web aceita um parâmetro 'quantidade' para retornar registros, mas não limita o valor máximo. Um atacante envia quantidade=999999999, forçando a aplicação a alocar gigabytes de memória ou executar query que consome toda a CPU, derrubando o serviço para usuários legítimos.

How to mitigate

Implemente validação explícita para toda entrada numérica ou de tamanho: defina limites mínimos e máximos aceitáveis, rejeite silenciosamente o que sair desses intervalos e registre tentativas suspeitas. Use whitelist de valores válidos quando possível.

CVE-2026-87470CRITICALImproper quantity validation in Tint in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbiEPSS 0.5%CVE-2026-102183HIGHJunos OS and Junos OS Evolved: If in a BGP EVPN scenario a malformed NLRI is received rpd crashesEPSS 0.5%CVE-2026-102016HIGHJunos OS and Junos OS Evolved: An attacker causes a routing outage when BGP MVPN signaling is enabledEPSS 0.5%CVE-2026-16025HIGHImproper Payment Validation in PayTR's PayTR Virtual Pos iFrame API WHMCS ModuleEPSS 0.5%CVE-2026-59252HIGHMissing gas_limit validation in mpp Tempo fee-payer enables wallet drainEPSS 0.5%CVE-2026-59531HIGHWordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.10.0 - Unknown vulnerabilityEPSS 0.5%CVE-2026-102184HIGHJunos OS and Junos OS Evolved: A malformed EVPN SRv6 route causes an rpd crashEPSS 0.5%CVE-2026-102065HIGHJunos OS and Junos OS Evolved: A malformed SRv6 service route causes an rpd crash when dynamic tunnels are enabledEPSS 0.5%CVE-2026-57023HIGHJunos OS: MX with SPC3, SRX Series: A specifically malformed TCP packet causes a flowd crashEPSS 0.5%CVE-2026-93749HIGHsource-map-js through 1.2.1 Event Loop Denial of ServiceEPSS 0.5%CVE-2025-11594MEDIUMywxbear PHP-Bookstore-Website-Example Quantity index.php improper validation of specified quantity in inputEPSS 0.5%CVE-2022-25727CRITICALMemory Corruption in modem due to improper length check while copying into memory in Snapdragon Consumer IOT, Snapdragon Industrial IOT, SnaEPSS 0.5%CVE-2026-12974HIGHSecurity Policy Bypass in Forcepoint Security Engine (NGFW)EPSS 0.5%CVE-2025-36092MEDIUMIBM Business Automation Insights improper input validationEPSS 0.5%CVE-2025-10259MEDIUMDenial-of-Service(DoS) Vulnerability in TCP Communication Function on MELSEC iQ-F Series CPU moduleEPSS 0.5%CVE-2026-25863HIGHConditional Fields for Contact Form 7 < 2.7.3 DoS via Uncontrolled Resource ConsumptionEPSS 0.5%CVE-2026-116581HIGHSeroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)EPSS 0.5%CVE-2026-12059HIGHCellopoint｜CelloOS - Improper Access ControlEPSS 0.4%CVE-2024-5931MEDIUMBT: Unchecked user input in bap_broadcast_assistantEPSS 0.4%CVE-2025-65548CRITICALNUT-14 allows cashu tokens to be created with a preimage hash. However, nutshell (cashubtc/nuts) before 0.18.0 do not validate the size of pEPSS 0.4%