Weaknesses of type CWE-476

2,333 results

Desreferência de nulo autenticada remota

A aplicação não valida corretamente se um ponteiro ou referência é nulo antes de usá-lo, permitindo que um usuário autenticado remotamente forneça entrada que causa uma desreferência de nulo. O resultado é um crash da aplicação ou, em cenários mais graves, execução de código não prevista, dependendo de como a memória é tratada.

Example

Um endpoint de API autenticada que busca um usuário por ID, mas não verifica se o resultado da busca é nulo. Um atacante autenticado fornece um ID inexistente, o código tenta acessar propriedades do resultado nulo e a aplicação falha ou se comporta de forma imprevista.

How to mitigate

Sempre validar retornos de funções que podem ser nulos antes de acessar seus membros ou métodos. Use assertions, verificações explícitas (if obj != null) ou mecanismos de linguagem como optional/Maybe types para forçar o tratamento seguro de valores nulos.

CVE-2026-92417HIGHOpen5GS PFCP types.c ogs_pfcp_parse_volume_measurement null pointer dereferenceEPSS 0.7%CVE-2022-22232HIGHSRX Series: If Unified Threat Management (UTM) Enhanced Content Filtering (CF) is enabled and specific traffic is processed the PFE will crashEPSS 0.7%CVE-2022-41787HIGHBIG-IP DNS Express vulnerability CVE-2022-41787EPSS 0.7%CVE-2024-24783MEDIUMVerify panics on certificates with an unknown public key algorithm in crypto/x509EPSS 0.7%CVE-2024-37605MEDIUMA NULL pointer dereference in D-Link DIR-860L REVB_FIRMWARE_2.04.B04_ic5b allows attackers to cause a Denial of Service (DoS) via a crafted EPSS 0.7%CVE-2026-46334HIGHOpenSIPS: Denial of Service in SDP bandwidth parsing via QoS SDP cloningEPSS 0.7%CVE-2026-47220HIGHEnvoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log formatEPSS 0.7%CVE-2026-58161CRITICALApache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the serverEPSS 0.7%CVE-2026-62309HIGHCoreDNS: proxyproto plugin panics on PPv2 datagram with non-UDP transport — single 28-byte packet remote DoSEPSS 0.7%CVE-2026-39835MEDIUMInvoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/sshEPSS 0.7%CVE-2024-23083MEDIUMTime4J Base v5.9.3 was discovered to contain a NullPointerException via the component net.time4j.format.internal.FormatUtils::useDefaultWeekEPSS 0.7%CVE-2023-38670MEDIUMNull pointer dereference in paddle.flipEPSS 0.7%CVE-2022-43495MEDIUMAn abnormal packet recieved when distributedhardware_device_manager joining a network could cause a device reboot.EPSS 0.7%CVE-2024-7652HIGHType Confusion in Async Generators in Javascript EngineEPSS 0.7%CVE-2021-39977HIGHThe HwNearbyMain module has a NULL Pointer Dereference vulnerability.Successful exploitation of this vulnerability may cause a process to reEPSS 0.7%CVE-2026-44316HIGHfree5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereferenceEPSS 0.7%CVE-2021-39988HIGHThe HwNearbyMain module has a NULL Pointer Dereference vulnerability.Successful exploitation of this vulnerability may cause a process to reEPSS 0.7%CVE-2026-45084HIGHOpenSIPS: Denial of service in presence.handle_publish() from unchecked Content-Type stateEPSS 0.7%CVE-2024-11705CRITICAL`NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was passed as NULL, a segmentation fault (SEGV)EPSS 0.7%CVE-2024-36626MEDIUMIn prestashop 8.1.4, a NULL pointer dereference was identified in the math_round function within Tools.php.EPSS 0.7%