Fallos del tipo CWE-130

117 resultados

Inconsistência no tratamento do parâmetro de comprimento

A fraqueza ocorre quando o código não valida ou não sincroniza corretamente o parâmetro de comprimento (length) com o tamanho real do buffer ou dado sendo manipulado. Se o desenvolvedor confia em um comprimento fornecido sem verificar sua coerência com o espaço disponível, buffers podem ser sobrescritos, causando corrupção de memória ou execução arbitrária.

Ejemplo

Uma função C que copia dados baseada em um tamanho informado pelo usuário sem validar se esse tamanho não ultrapassa o buffer alocado: `memcpy(dest, src, user_provided_length)`. Se user_provided_length for maior que sizeof(dest), haverá estouro de buffer.

Cómo mitigar

Sempre validar que o parâmetro de comprimento não ultrapassa o tamanho máximo do buffer alvo antes de usar (ex: verificar `length <= buffer_size`). Use funções seguras como `strncpy` ou `memcpy_s` que aceitam limite explícito, e sanitize todo input externo que influencie o comprimento.

CVE-2026-73455HIGHSecurity Advisory 0173EPSS 0.5%CVE-2026-26081MEDIUMHAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also EPSS 0.5%CVE-2024-53856HIGHrPGP Panics on Malformed Untrusted InputEPSS 0.5%CVE-2022-41586HIGHThe communication framework module has a vulnerability of not truncating data properly.Successful exploitation of this vulnerability may affEPSS 0.5%CVE-2026-42216HIGHOpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansionEPSS 0.5%CVE-2024-42460MEDIUMIn the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit EPSS 0.5%CVE-2024-37305HIGHBuffer overflow in deserialization in oqs-provider EPSS 0.4%CVE-2026-81575HIGHMissing Sanity Checks for Buffer LengthsEPSS 0.4%CVE-2025-29931MEDIUMA vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected product does not properly validate aEPSS 0.4%CVE-2026-43125CRITICALdlm: validate length in dlm_search_rsb_treeEPSS 0.4%CVE-2026-22255HIGHiccDEV has heap-buffer-overflow in CIccCLUT::Init() at IccProfLib/IccTagLut.cppEPSS 0.4%CVE-2026-5766MEDIUMPotential denial-of-service vulnerability in ASGI requests via file upload limit bypassEPSS 0.4%CVE-2025-30659HIGHJunos OS: SRX Series: A device configured for vector routing crashes when receiving malformed trafficEPSS 0.4%CVE-2026-6432MEDIUMImproper bounds validation in EmberZNet SDKEPSS 0.4%CVE-2026-41035HIGHIn rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. TEPSS 0.4%CVE-2025-32366MEDIUMIn ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length that depends on an RR RDLENGTH value, i.e., *rdlen=ntohs(rr->rdlen) and EPSS 0.4%CVE-2026-22047HIGHiccDEV has heap-buffer-overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cppEPSS 0.4%CVE-2026-14587MEDIUMUnathenticated connection can hold Bolt channel openEPSS 0.4%CVE-2026-3868HIGHAn improper handling of the length parameter inconsistency vulnerability has been identified in Moxa’s Secure Router. Because of improper vaEPSS 0.4%CVE-2025-53604MEDIUMThe web-push crate before 0.10.3 for Rust allows a denial of service (memory consumption) in the built-in clients via a large integer in a CEPSS 0.4%