Weaknesses of type CWE-1286

97 results

Validação inadequada da sintaxe de entrada

A aplicação aceita dados de entrada sem verificar se estão sintaticamente corretos conforme o formato esperado (JSON, XML, CSV, expressões regulares, etc.). Isso permite que dados malformados ou injetados passem pela validação e causem comportamentos inesperados: parsing incorreto, execução de lógica não prevista ou até injeção de código.

Example

Um parser JSON que não valida chaves duplicadas ou tipos de dados antes de processar deixa passar um payload malicioso. Ou um formulário que aceita emails sem verificar o símbolo '@', causando erro em operações que assumem formato válido.

How to mitigate

Sempre validar entrada contra um schema ou padrão esperado (whitelist) antes de processar: use bibliotecas de parsing robustas com validação integrada, implemente regex ou schema validation (JSONSchema, etc.), e teste com entradas malformadas. Rejeitar (não apenas limpar) dados sintaticamente inválidos.

CVE-2024-7954CRITICALSPIP porte_plume Plugin Arbitrary PHP ExecutionEPSS 90.1%CVE-2024-51983HIGHUnauthenticated Denial of Service (DoS) via malformed WS-Scan request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.EPSS 10.1%CVE-2024-51982HIGHUnauthenticated Denial of Service (DoS) via malformed PJL request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, and Ricoh.EPSS 9.3%CVE-2025-13878HIGHMalformed BRID/HHIT records can cause named to terminate unexpectedlyEPSS 9.2%CVE-2026-21527MEDIUMMicrosoft Exchange Server Spoofing VulnerabilityEPSS 8.0%CVE-2023-27043MEDIUMThe email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2EPSS 2.5%CVE-2021-28812HIGHCommand Injection Vulnerability in Video StationEPSS 1.6%CVE-2022-1941HIGHOut of Memory issue in ProtocolBuffers for cpp and pythonEPSS 1.5%CVE-2026-42579HIGHNetty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)EPSS 1.0%CVE-2024-6763LOWJetty URI parsing of invalid authorityEPSS 1.0%CVE-2021-31988—A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and EPSS 1.0%CVE-2021-31987—A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recipEPSS 0.9%CVE-2024-3384HIGHPAN-OS: Firewall Denial of Service (DoS) via Malformed NTLM PacketsEPSS 0.9%CVE-2025-25007MEDIUMMicrosoft Exchange Server Spoofing VulnerabilityEPSS 0.9%CVE-2025-22868HIGHUnexpected memory consumption during token parsing in golang.org/x/oauth2EPSS 0.9%CVE-2024-29041MEDIUMExpress.js Open Redirect in malformed URLsEPSS 0.8%CVE-2022-22192HIGHJunos OS Evolved: PTX Series: An attacker can cause a kernel panic by sending a malformed TCP packet to the deviceEPSS 0.7%CVE-2026-7307HIGHKeycloak: keycloak: denial of service via specially crafted saml inputEPSS 0.7%CVE-2026-25679HIGHIncorrect parsing of IPv6 host literals in net/urlEPSS 0.7%CVE-2021-44695MEDIUMAffected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deniEPSS 0.7%