Weaknesses of type CWE-440

41 results

Violação de Comportamento Esperado

É uma fraqueza genérica que descreve quando o software se comporta de forma diferente do que foi especificado ou esperado, violando contrato, protocolo ou lógica documentada. Atacantes exploram essa discrepância entre o esperado e o real para contornar controles de segurança ou causar danos.

Example

Um validador de entrada que deveria rejeitar requisições com payload > 1MB, mas falha quando o cliente envia dados em chunks—cada chunk passa na validação individual, mas juntos ultrapassam o limite. O software se comporta diferente do prometido.

How to mitigate

Documente explicitamente o comportamento esperado em testes automatizados e especificações; implemente validações em todos os pontos de entrada (não apenas parcialmente); revise regularmente discrepâncias entre documentação e código real para evitar que comportamentos não-documentados virem brechas de segurança.

CVE-2019-5108HIGHAn exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerabilitEPSS 10.1%CVE-2023-6129MEDIUMPOLY1305 MAC implementation corrupts vector registers on PowerPCEPSS 2.3%CVE-2021-41035—In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methEPSS 1.7%CVE-2018-12550—When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty, or contains only commeEPSS 1.4%CVE-2019-6569—The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into the mirrored network.EPSS 1.3%CVE-2023-2088MEDIUMA flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A rEPSS 1.2%CVE-2019-5061HIGHAn exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates fEPSS 0.9%CVE-2023-4807HIGHPOLY1305 MAC implementation corrupts XMM registers on WindowsEPSS 0.9%CVE-2024-56202MEDIUMApache Traffic Server: Expect header field can unreasonably retain resourceEPSS 0.8%CVE-2024-32971CRITICALDefect in query plan cache may cause incorrect operations to be executed in Apollo RouterEPSS 0.7%CVE-2022-3281HIGHWAGO: multiple products - Loss of MAC-Address-Filtering after rebootEPSS 0.7%CVE-2026-8806HIGHDenial-of-service (DoS) vulnerability in MELSEC iQ-F Series FX5-ENET/IP Ethernet moduleEPSS 0.6%CVE-2024-30246HIGHTuleap deleting or moving an artifact can delete values from unrelated artifactsEPSS 0.6%CVE-2026-42534MEDIUMJostle logic bypass degrades resolution performanceEPSS 0.6%CVE-2019-5062HIGHAn exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 80EPSS 0.5%CVE-2023-32732MEDIUMDenial-of-Service in gRPCEPSS 0.5%CVE-2023-32731HIGHInformation leak in gRPCEPSS 0.5%CVE-2025-46712LOWErlang/OTP SSH Has Strict KEX ViolationsEPSS 0.5%CVE-2020-10766MEDIUMA logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD. A bug in the logic handling allows an attacker withEPSS 0.5%CVE-2025-8850LOWInsecure API Design in danny-avila/librechatEPSS 0.4%