Fallos del tipo CWE-754

507 resultados

Falta de verificação de condições excepcionais

O software não valida ou valida incorretamente situações anormais que raramente ocorrem no operação rotineira, deixando o código vulnerável quando essas condições inesperadas acontecem. Isso causa comportamento indefinido, crash ou exploração, porque o desenvolvedor assumiu que 'isso nunca vai acontecer' sem proteção.

Ejemplo

Um parser de arquivo de imagem assume que o header sempre terá exatamente 256 bytes sem checar o tamanho real; quando recebe um arquivo malformado com header menor, acessa memória além do esperado causando leitura fora de limites ou corrupção.

Cómo mitigar

Valide explicitamente todas as entradas e estados críticos, mesmo aqueles aparentemente impossíveis: use asserções em desenvolvimento, trate exceções esperadas e adicione limites de segurança (timeouts, limites de tamanho). Teste com entradas malformadas e corner cases, não apenas fluxo feliz.

CVE-2026-0667CRITICALCWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service andEPSS 0.5%CVE-2022-3616MEDIUMOctoRPKI crash when maximum iterations number is reachedEPSS 0.5%CVE-2021-44856MEDIUMAn issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A title blocked by AbuseFilter can be crEPSS 0.5%CVE-2026-62334HIGHOpenVM's OpenVmHalo2Verifier self-call can bypass proof verificationEPSS 0.5%CVE-2026-77411CRITICALRabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstrEPSS 0.5%CVE-2026-48741HIGHlibIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoSEPSS 0.5%CVE-2024-30402HIGHJunos OS and Junos OS Evolved: The l2ald crashes on receiving telemetry messages from a specific subscriptionEPSS 0.5%CVE-2025-52981HIGHJunos OS: SRX Series: Sequence of specific PIM packets causes a flowd crashEPSS 0.5%CVE-2024-9124HIGHRockwell Automation PowerFlex 6000T CIP Security denial-of-service VulnerabilityEPSS 0.5%CVE-2022-41587MEDIUMUncaptured exceptions in the home screen module. Successful exploitation of this vulnerability may affect stability.EPSS 0.5%CVE-2023-44099—Vulnerability of data verification errors in the kernel module. Successful exploitation of this vulnerability may cause WLAN interruption.EPSS 0.5%CVE-2026-24054HIGHKata Containers Runtime: Host block device can be hotplugged to the VM if the container image is malformed or contains no layersEPSS 0.5%CVE-2023-5967MEDIUMDenial of Service via crashing the Calls PluginEPSS 0.5%CVE-2024-21603MEDIUMJunos OS: MX Series: Gathering statistics in a scaled SCU/DCU configuration will lead to a device crashEPSS 0.5%CVE-2026-73429MEDIUMRussh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)EPSS 0.5%CVE-2024-21586HIGHJunos OS: SRX Series and NFX Series: Specific valid traffic leads to a PFE crashEPSS 0.5%CVE-2026-19481HIGH@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part headerEPSS 0.5%CVE-2021-33139MEDIUMImproper conditions check in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.100 mayEPSS 0.5%CVE-2024-39545HIGHJunos OS: SRX Series, MX Series with SPC3 and NFX350: When VPN tunnels parameters are not configured in specific way the iked process will crashEPSS 0.5%CVE-2024-39540HIGHJunos OS: SRX Series, and MX Series with SPC3: Specific valid TCP traffic can cause a pfe crashEPSS 0.5%