Fallos del tipo CWE-754

461 resultados

Falta de verificação de condições excepcionais

O software não valida ou valida incorretamente situações anormais que raramente ocorrem no operação rotineira, deixando o código vulnerável quando essas condições inesperadas acontecem. Isso causa comportamento indefinido, crash ou exploração, porque o desenvolvedor assumiu que 'isso nunca vai acontecer' sem proteção.

Ejemplo

Um parser de arquivo de imagem assume que o header sempre terá exatamente 256 bytes sem checar o tamanho real; quando recebe um arquivo malformado com header menor, acessa memória além do esperado causando leitura fora de limites ou corrupção.

Cómo mitigar

Valide explicitamente todas as entradas e estados críticos, mesmo aqueles aparentemente impossíveis: use asserções em desenvolvimento, trate exceções esperadas e adicione limites de segurança (timeouts, limites de tamanho). Teste com entradas malformadas e corner cases, não apenas fluxo feliz.

CVE-2026-21693HIGHiccDEV has Type Confusion in CIccSegmentedCurveXml::ToXml() at IccXML/IccLibXML/IccMpeXml.cppEPSS 0.4%CVE-2026-0262MEDIUMPAN-OS: Denial of Service Vulnerabilities in Network Traffic ParsingEPSS 0.4%CVE-2023-4828MEDIUMITM Server Communications HijackEPSS 0.4%CVE-2023-44198MEDIUMJunos OS: SRX Series and MX Series: SIP ALG doesn't drop specifically malformed retransmitted SIP packetsEPSS 0.4%CVE-2026-73429MEDIUMRussh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)EPSS 0.4%CVE-2026-20776HIGHImproper conditions check for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow a denial of service. NetwoEPSS 0.4%CVE-2023-28910HIGHDisabled Abortion FlagEPSS 0.4%CVE-2022-20804MEDIUMCisco Unified Communications Products Denial of Service VulnerabilityEPSS 0.4%CVE-2026-20719MEDIUMDoS via URL Previews Rendering Malicious SVGsEPSS 0.4%CVE-2026-44317MEDIUMfree5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereferenceEPSS 0.4%CVE-2024-30397HIGHJunos OS: An invalid certificate causes a Denial of Service in the Internet Key Exchange (IKE) processEPSS 0.3%CVE-2026-46541HIGHNimiq network-libp2p: DHT query poisoning via first-record verification failureEPSS 0.3%CVE-2024-43435MEDIUMMoodle: can create global glossary without being adminEPSS 0.3%CVE-2026-55484HIGHALOS HTTP: Unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire serverEPSS 0.3%CVE-2026-45678HIGHOpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloadsEPSS 0.3%CVE-2025-14322HIGHSandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL componentEPSS 0.3%CVE-2022-22217MEDIUMJunos OS: QFX10K Series: Denial of Service (DoS) upon receipt of crafted MLD packets on multi-homing ESI in VXLANEPSS 0.3%CVE-2026-47216HIGHTypesense: Unauthenticated Denial of Service in the Typesense /multi_search EndpointEPSS 0.3%CVE-2026-0241MEDIUMTrust Protection Foundation: Multiple Authorization Bypass VulnerabilitiesEPSS 0.3%CVE-2025-52931HIGHUnexpected input to Update Channel Subscription endpoint causes DoS in Mattermost Confluence PluginEPSS 0.3%