Fallos del tipo CWE-1284
327 resultadosValidação inadequada de quantidade especificada em entrada
Ocorre quando a aplicação aceita um parâmetro que define uma quantidade (tamanho de buffer, número de iterações, limite de registros) sem validar se esse valor está dentro de limites seguros. Um atacante pode especificar quantidades excessivas, causando consumo de recursos, overflow de memória ou lógica comprometida.
Ejemplo
Um endpoint REST recebe `?limit=999999999` para pagination sem checar se o valor é razoável, causando alocação massiva de memória ou timeout. Ou um parser aceita `Content-Length: -1` sem validar valores negativos, causando comportamento indefinido.
Cómo mitigar
Sempre validar limites mínimos e máximos de qualquer quantidade recebida do usuário antes de usar em alocação de memória, loops ou operações de I/O. Defina ranges explícitos (ex: `1 ≤ limit ≤ 1000`) e rejeite valores fora desse intervalo.
CVE-2023-31331LOWImproper access control in the DRTM firmware could allow a privileged attacker to perform multiple driver initializations, resulting in stacEPSS 0.2%CVE-2026-57062LOWCMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is suppEPSS 0.1%CVE-2026-6839MEDIUMImproper validation of STRING tensor offsets could allows malformed string metadata to trigger out of bounds access during constant tensor iEPSS 0.1%CVE-2022-4989HIGH** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to acceEPSS 0.1%CVE-2023-31310MEDIUMImproper input validation in Power Management Firmware (PMFW) may allow an attacker with privileges to send a malformed input for the "set tEPSS 0.1%CVE-2023-20508MEDIUMImproper access control in the ASP could allow a privileged attacker to perform an out-of-bounds write to a memory location not controlled bEPSS 0.1%CVE-2026-57053MEDIUMGNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicoEPSS 0.1%CVE-2024-36346MEDIUMImproper input validation in AMD Power Management Firmware (PMFW) could allow a privileged attacker from Guest VM to send arbitrary input daEPSS 0.1%CVE-2026-47329LOWIncorrect validation of field size in Ubuntu Linux AppArmor notification responsesEPSS 0.1%CVE-2022-4990HIGH** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to bypaEPSS 0.1%CVE-2025-0038MEDIUMIn AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime services through the PMU Firmware can allow accesEPSS 0.1%CVE-2022-20488HIGHIn NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. EPSS 0.1%CVE-2025-54515LOWThe Secure Flag passed to Versal™ Adaptive SoC’s Trusted Firmware for Cortex®-A processors (TF-A) for Arm’s Power State Coordination InterfaEPSS 0.1%CVE-2023-20708MEDIUMIn keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with SEPSS 0.1%CVE-2025-11568MEDIUMLuksmeta: data corruption when handling luks1 partitions with luksmetaEPSS 0.1%CVE-2026-0428LOWInsufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_COPY_VF_CHIPLET_REGSEPSS 0.1%CVE-2025-66660LOWInsufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_CHECK_TA_COMPAT to cEPSS 0.1%CVE-2023-20707MEDIUMIn ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System EPSS 0.1%CVE-2021-0934MEDIUMIn findAllDeAccounts of AccountsDb.java, there is a possible denial of service due to resource exhaustion. This could lead to local denial oEPSS 0.1%CVE-2023-20710MEDIUMIn keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with SyEPSS 0.1%