Falhas do tipo CWE-130

117 resultados

Tratamento inadequado de inconsistência em parâmetros de comprimento

Ocorre quando o código não valida ou não sincroniza corretamente parâmetros que indicam o comprimento de dados (strings, buffers, arrays). Se o comprimento declarado não bate com o tamanho real, o código pode ler/escrever além dos limites, causando corrupção de memória, leitura de dados sensíveis ou crash.

Exemplo

Uma API recebe um buffer e um inteiro 'length' como parâmetro. Se o desenvolvedor não verifica se 'length' é realmente igual ao tamanho alocado do buffer, um atacante pode informar um valor artificialmente alto e provocar leitura de memória além do esperado.

Como mitigar

Sempre validar que o parâmetro de comprimento corresponde aos limites reais do dado (tamanho alocado, string terminada em null, etc). Use funções seguras que garantem limites (como strncpy em vez de strcpy) e implemente verificações explícitas antes de qualquer operação que dependa desse parâmetro.

CVE-2022-20690MEDIUMMultiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allowEPSS 0.7%CVE-2024-29064MEDIUMWindows Hyper-V Denial of Service VulnerabilityEPSS 0.7%CVE-2023-5393HIGHServer receiving a malformed message that causes a disconnect to a hostname may causing a stack overflow resulting in possible remote code eEPSS 0.7%CVE-2023-33192HIGHImproper handling of NTS cookie length that could crash the ntpd-rs serverEPSS 0.7%CVE-2026-22861HIGHiccDEV has a heap-buffer-overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cppEPSS 0.7%CVE-2021-27862MEDIUML2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with an invalid length during Ethernet to Wifi frame translationEPSS 0.7%CVE-2022-20689MEDIUMMultiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allowEPSS 0.7%CVE-2023-28964HIGHJunos OS and Junos OS Evolved: Malformed BGP flowspec update causes RPD crashEPSS 0.6%CVE-2025-29784HIGHNamelessMC Has Lack of Length Validation for s Parameter in GET RequestsEPSS 0.6%CVE-2026-5265MEDIUMOvn: ovn: heap over-read in icmp error response generationEPSS 0.6%CVE-2022-36788HIGHA heap-based buffer overflow vulnerability exists in the TriangleMesh clone functionality of Slic3r libslic3r 1.3.0 and Master Commit b1a550EPSS 0.6%CVE-2021-27861MEDIUML2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with invalid lengthsEPSS 0.6%CVE-2020-16224—Philips Patient Monitoring Devices Improper Handling of Length Parameter InconsistencyEPSS 0.6%CVE-2025-5514MEDIUMDenial-of-Service(DoS) Vulnerability in Web server function on MELSEC iQ-F Series CPU moduleEPSS 0.6%CVE-2023-50248MEDIUMCKAN out of memory error when submitting the dataset form with a specially-crafted fieldEPSS 0.6%CVE-2026-58096HIGHppp(8): missing length validation in LcpDecodeConfig()EPSS 0.6%CVE-2026-90678HIGHAn issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy mEPSS 0.5%CVE-2023-53157MEDIUMThe rosenpass crate before 0.2.1 for Rust allows remote attackers to cause a denial of service (panic) via a one-byte UDP packet.EPSS 0.5%CVE-2020-10065LOWMissing Size Checks in Bluetooth HCI over SPIEPSS 0.5%CVE-2026-33936MEDIUMpython-ecdsa: Denial of Service via improper DER length validation in crafted private keysEPSS 0.5%