Weaknesses of type CWE-228

20 results

Tratamento inadequado de estruturas sintaticamente inválidas

O software não valida ou trata corretamente dados que violam a sintaxe esperada (como campos ausentes, tipos incorretos ou formato malformado). Quando isso acontece, o programa pode falhar, comportar-se de forma impredizível ou ser explorado para contornar lógica de segurança.

Example

Um parser JSON que tenta acessar um campo aninhado sem verificar se os níveis anteriores existem, ou uma API que aceita um valor inteiro em um campo que deveria ser uma string — e depois usa esse valor sem conversão adequada, causando comportamento inesperado.

How to mitigate

Implemente validação de schema rigorosa antes de processar dados (use schemas JSON, DTD ou validadores nativos da linguagem). Sempre verifique a existência e o tipo de cada campo crítico, e falhe de forma segura se a estrutura não corresponder ao esperado.

CVE-2018-5381MEDIUMThe Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgp_packet.c:bgpEPSS 30.2%CVE-2021-38443MEDIUMEclipse CycloneDDS Improper Handling of Syntactically Invalid StructureEPSS 2.1%CVE-2020-27847—A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allowEPSS 1.7%CVE-2021-36199MEDIUMVideoEdgeEPSS 1.0%CVE-2026-42100HIGHDoS in Sparx Pro Cloud ServerEPSS 0.7%CVE-2024-21612HIGHJunos OS Evolved: Specific TCP traffic causes OFP core and restart of REEPSS 0.5%CVE-2024-55594MEDIUMAn improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 EPSS 0.5%CVE-2026-34232HIGHFirebird: DoS via `op_response` packet from clientEPSS 0.5%CVE-2023-42784MEDIUMAn improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 aEPSS 0.4%CVE-2024-53828MEDIUMEricsson Packet Core Controller (PCC) - Improper Handling of Syntactically Invalid Structure VulnerabilityEPSS 0.4%CVE-2025-0343HIGHSwift ASN.1 can be caused to crash when parsing certain BER/DER constructions. This crash is caused by a confusion in the ASN.1 library itseEPSS 0.3%CVE-2026-20125HIGHA vulnerability in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE Software Release 3E could allow an authenticated, remote aEPSS 0.3%CVE-2024-6382MEDIUMAdversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands.EPSS 0.3%CVE-2024-22809MEDIUMIncorrect access control in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to access the G code's shared folder andEPSS 0.3%CVE-2025-47736LOWdialect/mod.rs in the libsql-sqlite3-parser crate through 0.13.0 before 14f422a for Rust can crash if the input is not valid UTF-8.EPSS 0.2%CVE-2024-22815MEDIUMAn issue in the communication protocol of Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of ServiEPSS 0.2%CVE-2025-2529LOWIBM Terracotta denial of serviceEPSS 0.2%CVE-2026-50103HIGHImproper Handling of Syntactically Invalid Structure in MZ Automation libIEC61850EPSS 0.2%CVE-2025-59174HIGHEricsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability where an attacker sending a large volume of specially cEPSS 0.2%CVE-2026-25657HIGHEricsson Packet Core Gateway (PCG) - Improper Handling of Syntactically Invalid Structure VulnerabilityEPSS 0.2%