Weaknesses of type CWE-1284

387 results

Validação inadequada da quantidade de dados em entrada

A aplicação não valida corretamente a quantidade, tamanho ou volume de dados que recebe do usuário, permitindo que entradas maiores ou menores que o esperado passem pelo controle. Isso abre espaço para ataques de negação de serviço, estouro de buffer, consumo excessivo de recursos ou processamento de dados malformados.

Example

Um serviço web aceita um parâmetro 'quantidade' para retornar registros, mas não limita o valor máximo. Um atacante envia quantidade=999999999, forçando a aplicação a alocar gigabytes de memória ou executar query que consome toda a CPU, derrubando o serviço para usuários legítimos.

How to mitigate

Implemente validação explícita para toda entrada numérica ou de tamanho: defina limites mínimos e máximos aceitáveis, rejeite silenciosamente o que sair desses intervalos e registre tentativas suspeitas. Use whitelist de valores válidos quando possível.

CVE-2025-65548CRITICALNUT-14 allows cashu tokens to be created with a preimage hash. However, nutshell (cashubtc/nuts) before 0.18.0 do not validate the size of pEPSS 0.4%CVE-2026-71394MEDIUMHeap Use of Uninitialized Memory in GNU Emacs for AndroidEPSS 0.4%CVE-2026-8047HIGHOut-of-bounds Write in CODESYS ControlEPSS 0.4%CVE-2022-26047MEDIUMImproper input validation for some Intel(R) PROSet/Wireless WiFi, Intel vPro(R) CSME WiFi and Killer(TM) WiFi products may allow unauthenticEPSS 0.4%CVE-2024-3317MEDIUMSailPoint Identity Security Cloud Improper Access ControlEPSS 0.4%CVE-2026-34756MEDIUMvLLM Affected by Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API ServerEPSS 0.4%CVE-2021-47827MEDIUMWebSSH for iOS 14.16.10 - 'mashREPL' Denial of ServiceEPSS 0.4%CVE-2021-47818MEDIUMDupTerminator 1.4.5639.37199 - Denial of ServiceEPSS 0.4%CVE-2026-103594CRITICALFireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code ExecutionEPSS 0.4%CVE-2026-0925LOWTanium addressed an improper input validation vulnerability in Discover.EPSS 0.4%CVE-2025-43970MEDIUMAn issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that thereEPSS 0.4%CVE-2026-30575HIGHA Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-stock.php file. The application faEPSS 0.4%CVE-2026-1101MEDIUMImproper Validation of Specified Quantity in Input in GitLabEPSS 0.4%CVE-2026-43928LOWFOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpaymentEPSS 0.4%CVE-2025-13078MEDIUMImproper Validation of Specified Quantity in Input in GitLabEPSS 0.4%CVE-2026-103484HIGHpgvector buffer overflow in IVFFlat index buildEPSS 0.4%CVE-2026-10822MEDIUMKey Record using PRIVATEDNS algorithm may lead to unexpected exitEPSS 0.4%CVE-2026-59317MEDIUMIn Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loopEPSS 0.4%CVE-2025-43964LOWIn LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values.EPSS 0.4%CVE-2026-11906MEDIUMIBM® Db2® federated server is vulnerable to a denial of service due to improper neutralization of special elements in the data query logic of XMLTable-derived columns by autheticated userEPSS 0.4%