Fallos del tipo CWE-130

117 resultados

Inconsistência no tratamento do parâmetro de comprimento

A fraqueza ocorre quando o código não valida ou não sincroniza corretamente o parâmetro de comprimento (length) com o tamanho real do buffer ou dado sendo manipulado. Se o desenvolvedor confia em um comprimento fornecido sem verificar sua coerência com o espaço disponível, buffers podem ser sobrescritos, causando corrupção de memória ou execução arbitrária.

Ejemplo

Uma função C que copia dados baseada em um tamanho informado pelo usuário sem validar se esse tamanho não ultrapassa o buffer alocado: `memcpy(dest, src, user_provided_length)`. Se user_provided_length for maior que sizeof(dest), haverá estouro de buffer.

Cómo mitigar

Sempre validar que o parâmetro de comprimento não ultrapassa o tamanho máximo do buffer alvo antes de usar (ex: verificar `length <= buffer_size`). Use funções seguras como `strncpy` ou `memcpy_s` que aceitam limite explícito, e sanitize todo input externo que influencie o comprimento.

CVE-2022-20690MEDIUMMultiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allowEPSS 0.7%CVE-2024-29064MEDIUMWindows Hyper-V Denial of Service VulnerabilityEPSS 0.7%CVE-2023-5393HIGHServer receiving a malformed message that causes a disconnect to a hostname may causing a stack overflow resulting in possible remote code eEPSS 0.7%CVE-2023-33192HIGHImproper handling of NTS cookie length that could crash the ntpd-rs serverEPSS 0.7%CVE-2026-22861HIGHiccDEV has a heap-buffer-overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cppEPSS 0.7%CVE-2021-27862MEDIUML2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with an invalid length during Ethernet to Wifi frame translationEPSS 0.7%CVE-2022-20689MEDIUMMultiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allowEPSS 0.7%CVE-2023-28964HIGHJunos OS and Junos OS Evolved: Malformed BGP flowspec update causes RPD crashEPSS 0.6%CVE-2025-29784HIGHNamelessMC Has Lack of Length Validation for s Parameter in GET RequestsEPSS 0.6%CVE-2026-5265MEDIUMOvn: ovn: heap over-read in icmp error response generationEPSS 0.6%CVE-2022-36788HIGHA heap-based buffer overflow vulnerability exists in the TriangleMesh clone functionality of Slic3r libslic3r 1.3.0 and Master Commit b1a550EPSS 0.6%CVE-2021-27861MEDIUML2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with invalid lengthsEPSS 0.6%CVE-2020-16224—Philips Patient Monitoring Devices Improper Handling of Length Parameter InconsistencyEPSS 0.6%CVE-2025-5514MEDIUMDenial-of-Service(DoS) Vulnerability in Web server function on MELSEC iQ-F Series CPU moduleEPSS 0.6%CVE-2023-50248MEDIUMCKAN out of memory error when submitting the dataset form with a specially-crafted fieldEPSS 0.6%CVE-2026-58096HIGHppp(8): missing length validation in LcpDecodeConfig()EPSS 0.6%CVE-2026-90678HIGHAn issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy mEPSS 0.5%CVE-2023-53157MEDIUMThe rosenpass crate before 0.2.1 for Rust allows remote attackers to cause a denial of service (panic) via a one-byte UDP packet.EPSS 0.5%CVE-2020-10065LOWMissing Size Checks in Bluetooth HCI over SPIEPSS 0.5%CVE-2026-33936MEDIUMpython-ecdsa: Denial of Service via improper DER length validation in crafted private keysEPSS 0.5%