Weaknesses of type CWE-476

2,333 results

Desreferência de nulo autenticada remota

A aplicação não valida corretamente se um ponteiro ou referência é nulo antes de usá-lo, permitindo que um usuário autenticado remotamente forneça entrada que causa uma desreferência de nulo. O resultado é um crash da aplicação ou, em cenários mais graves, execução de código não prevista, dependendo de como a memória é tratada.

Example

Um endpoint de API autenticada que busca um usuário por ID, mas não verifica se o resultado da busca é nulo. Um atacante autenticado fornece um ID inexistente, o código tenta acessar propriedades do resultado nulo e a aplicação falha ou se comporta de forma imprevista.

How to mitigate

Sempre validar retornos de funções que podem ser nulos antes de acessar seus membros ou métodos. Use assertions, verificações explícitas (if obj != null) ou mecanismos de linguagem como optional/Maybe types para forçar o tratamento seguro de valores nulos.

CVE-2026-85150HIGHGstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted digest authorization/www-authenticate headerEPSS 0.5%CVE-2025-69252MEDIUMfree5GC has Null Pointer Dereference in UDM, Leading to Service PanicEPSS 0.5%CVE-2025-64527MEDIUMEnvoy crashes when JWT authentication is configured with the remote JWKS fetchingEPSS 0.5%CVE-2026-68901MEDIUMWeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authToken Leads to Uncaught Exception / Remote Denial of ServiceEPSS 0.5%CVE-2025-59150HIGHSuricata: Keyword tls.subjectaltname can lead to NULL-ptr derefEPSS 0.5%CVE-2024-48615HIGHNull Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header_pax_extension at rchivEPSS 0.5%CVE-2024-25560HIGHTMM VulnerabilityEPSS 0.5%CVE-2022-26095MEDIUMNull pointer dereference vulnerability in parser_colr function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds writEPSS 0.5%CVE-2022-27567MEDIUMNull pointer dereference vulnerability in parser_hvcC function of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds writEPSS 0.5%CVE-2022-26094MEDIUMNull pointer dereference vulnerability in parser_auxC function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds writEPSS 0.5%CVE-2026-29781LOWSliver: Authenticated Nil-Pointer Dereference in HandlersEPSS 0.5%CVE-2022-26096MEDIUMNull pointer dereference vulnerability in parser_ispe function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds writEPSS 0.5%CVE-2022-26099MEDIUMNull pointer dereference vulnerability in parser_infe function of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds readEPSS 0.5%CVE-2022-26097MEDIUMNull pointer dereference vulnerability in parser_unknown_property function in libsimba library prior to SMR Apr-2022 Release 1 allows out ofEPSS 0.5%CVE-2022-26093MEDIUMNull pointer dereference vulnerability in parser_irot function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds writEPSS 0.5%CVE-2025-54163LOWFile Station 5EPSS 0.5%CVE-2024-36972HIGHaf_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock.EPSS 0.5%CVE-2025-32909MEDIUMLibsoup: null pointer dereference on libsoup through function "sniff_mp4" in soup-content-sniffer.cEPSS 0.5%CVE-2026-73199MEDIUMIpa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request valueEPSS 0.5%CVE-2024-35492HIGHCesanta Mongoose commit b316989 was discovered to contain a NULL pointer dereference via the scpy function at src/fmt.c. This vulnerability EPSS 0.5%