Fallos del tipo CWE-754

507 resultados

Falta de verificação de condições excepcionais

O software não valida ou valida incorretamente situações anormais que raramente ocorrem no operação rotineira, deixando o código vulnerável quando essas condições inesperadas acontecem. Isso causa comportamento indefinido, crash ou exploração, porque o desenvolvedor assumiu que 'isso nunca vai acontecer' sem proteção.

Ejemplo

Um parser de arquivo de imagem assume que o header sempre terá exatamente 256 bytes sem checar o tamanho real; quando recebe um arquivo malformado com header menor, acessa memória além do esperado causando leitura fora de limites ou corrupção.

Cómo mitigar

Valide explicitamente todas as entradas e estados críticos, mesmo aqueles aparentemente impossíveis: use asserções em desenvolvimento, trate exceções esperadas e adicione limites de segurança (timeouts, limites de tamanho). Teste com entradas malformadas e corner cases, não apenas fluxo feliz.

CVE-2026-79073HIGHImproper state validation in Parser in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code EPSS 0.4%CVE-2026-35225HIGHImproper timeout handling in CODESYS EtherNetIPEPSS 0.4%CVE-2024-52895MEDIUMIBM i denial of serviceEPSS 0.4%CVE-2026-33794HIGHJunos OS Evolved: PTX Series: Receipt of repeated ECMP routing updates results in PFE crashEPSS 0.4%CVE-2026-57022HIGHJunos OS: MX Series with SPC3, SRX Series: Specific packet in response to a TCP connection establishment by the affected device can crash the PFEEPSS 0.4%CVE-2026-44316HIGHfree5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereferenceEPSS 0.4%CVE-2021-0228MEDIUMJunos OS: MX Series: DDoS LACP violation upon receipt of specific layer 2 frames in EVPN-VXLAN deploymentEPSS 0.4%CVE-2026-54269MEDIUMprotobufjs: Schema-derived names can shadow runtime-significant propertiesEPSS 0.4%CVE-2024-45650HIGHIBM Security Verify Directory denial of serviceEPSS 0.4%CVE-2026-121098HIGHImproper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process EPSS 0.4%CVE-2024-39559HIGHJunos OS Evolved: Receipt of a specific TCP packet may result in a system crash (vmcore) on dual RE systems with NSR enabledEPSS 0.4%CVE-2026-73288MEDIUMRustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deletedEPSS 0.4%CVE-2025-61976HIGHCHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper check for unusual or exceptional conditions. If a remote attacker sends aEPSS 0.4%CVE-2025-12657MEDIUMMalformed KMIP response may result in access violationEPSS 0.4%CVE-2026-44322HIGHfree5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereferenceEPSS 0.4%CVE-2026-6772HIGHIncorrect boundary conditions in the Libraries component in NSSEPSS 0.4%CVE-2022-22196MEDIUMJunos OS and Junos OS Evolved: The rpd CPU spikes to 100% after a malformed ISIS TLV has been receivedEPSS 0.4%CVE-2021-0239MEDIUMJunos OS Evolved: Denial of Service due to receipt of specific genuine layer 2 frames.EPSS 0.4%CVE-2021-0288MEDIUMJunos OS: MX Series, EX9200 Series: FPC may crash upon receipt of specific MPLS packet affecting Trio-based MPCsEPSS 0.4%CVE-2026-121445HIGHsvg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS StrippingEPSS 0.4%