Falhas do tipo CWE-130

144 resultados

Tratamento inadequado de inconsistência em parâmetros de comprimento

Ocorre quando o código não valida ou não sincroniza corretamente parâmetros que indicam o comprimento de dados (strings, buffers, arrays). Se o comprimento declarado não bate com o tamanho real, o código pode ler/escrever além dos limites, causando corrupção de memória, leitura de dados sensíveis ou crash.

Exemplo

Uma API recebe um buffer e um inteiro 'length' como parâmetro. Se o desenvolvedor não verifica se 'length' é realmente igual ao tamanho alocado do buffer, um atacante pode informar um valor artificialmente alto e provocar leitura de memória além do esperado.

Como mitigar

Sempre validar que o parâmetro de comprimento corresponde aos limites reais do dado (tamanho alocado, string terminada em null, etc). Use funções seguras que garantem limites (como strncpy em vez de strcpy) e implemente verificações explícitas antes de qualquer operação que dependa desse parâmetro.

CVE-2026-101942HIGHJunos OS and Junos OS Evolved: An attacker causes rpd denial of service when EVPN route signaling is usedEPSS 0.4%CVE-2025-30659HIGHJunos OS: SRX Series: A device configured for vector routing crashes when receiving malformed trafficEPSS 0.4%CVE-2026-5766MEDIUMPotential denial-of-service vulnerability in ASGI requests via file upload limit bypassEPSS 0.4%CVE-2026-22255HIGHiccDEV has heap-buffer-overflow in CIccCLUT::Init() at IccProfLib/IccTagLut.cppEPSS 0.4%CVE-2025-53604MEDIUMThe web-push crate before 0.10.3 for Rust allows a denial of service (memory consumption) in the built-in clients via a large integer in a CEPSS 0.4%CVE-2025-32366MEDIUMIn ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length that depends on an RR RDLENGTH value, i.e., *rdlen=ntohs(rr->rdlen) and EPSS 0.4%CVE-2026-116531CRITICALHTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunkEPSS 0.4%CVE-2026-110912HIGHIn DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate tEPSS 0.4%CVE-2026-41035HIGHIn rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. TEPSS 0.4%CVE-2026-5706HIGHBuffer overflow in Bluetooth Mesh SDK when handling extended advertisementsEPSS 0.4%CVE-2026-101962HIGHJunos OS and Junos OS Evolved: An attacker sending a malformed update causes an rpd crash when BGP EVPN signaling is usedEPSS 0.4%CVE-2026-22047HIGHiccDEV has heap-buffer-overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cppEPSS 0.4%CVE-2026-54466CRITICALwebsocket-driver: Message corruption via abuse of protocol length headersEPSS 0.4%CVE-2026-119600MEDIUMtcpflow through 1.6.1 Out-of-Bounds Read via TCP Demultiplexer Payload LengthEPSS 0.4%CVE-2026-3868HIGHAn improper handling of the length parameter inconsistency vulnerability has been identified in Moxa’s Secure Router. Because of improper vaEPSS 0.4%CVE-2026-4371HIGHOut of bounds read in IMAP parsingEPSS 0.4%CVE-2026-119279MEDIUMMariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengthsEPSS 0.4%CVE-2026-119277MEDIUMMariaDB Connector/J: Rogue server can make the client read past the packet through server-declared lengthsEPSS 0.4%CVE-2026-119276MEDIUMMariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packetsEPSS 0.4%CVE-2026-18397CRITICALSConnect: Native Host Unauthenticated Remote Code Execution VulnerabilityEPSS 0.3%