Falhas do tipo CWE-130

144 resultados

Tratamento inadequado de inconsistência em parâmetros de comprimento

Ocorre quando o código não valida ou não sincroniza corretamente parâmetros que indicam o comprimento de dados (strings, buffers, arrays). Se o comprimento declarado não bate com o tamanho real, o código pode ler/escrever além dos limites, causando corrupção de memória, leitura de dados sensíveis ou crash.

Exemplo

Uma API recebe um buffer e um inteiro 'length' como parâmetro. Se o desenvolvedor não verifica se 'length' é realmente igual ao tamanho alocado do buffer, um atacante pode informar um valor artificialmente alto e provocar leitura de memória além do esperado.

Como mitigar

Sempre validar que o parâmetro de comprimento corresponde aos limites reais do dado (tamanho alocado, string terminada em null, etc). Use funções seguras que garantem limites (como strncpy em vez de strcpy) e implemente verificações explícitas antes de qualquer operação que dependa desse parâmetro.

CVE-2026-83745HIGHApache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D)EPSS 0.3%CVE-2026-94635HIGHApache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned nameEPSS 0.3%CVE-2026-22046HIGHiccDEV has heap-buffer-overflow in CIccProfileXml::ParseBasic() at IccXML/IccLibXML/IccProfileXml.cppEPSS 0.3%CVE-2026-71337HIGHWindows Storage Management Provider Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-102718HIGHOut-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER lengthEPSS 0.3%CVE-2026-60060MEDIUMImproper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm ProjecEPSS 0.3%CVE-2025-52949HIGHJunos OS and Junos OS Evolved: In an EVPN environment, receipt of specifically malformed BGP update causes RPD crashEPSS 0.3%CVE-2026-35547HIGHHeap overflow in libnvEPSS 0.3%CVE-2026-90921HIGHMaximo AI Service Denial of ServiceEPSS 0.3%CVE-2025-23247MEDIUMNVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a failure to check the length of a buffer coulEPSS 0.3%CVE-2026-85494HIGHApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language)EPSS 0.3%CVE-2026-40199MEDIUMNet::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypassEPSS 0.3%CVE-2026-33555MEDIUMAn issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announcEPSS 0.3%CVE-2026-114597HIGHImproper handling of length parameter inconsistency in EPICS BaseEPSS 0.3%CVE-2024-35313HIGHIn Tor Arti before 1.2.3, circuits sometimes incorrectly have a length of 3 (with full vanguards), aka TROVE-2024-004.EPSS 0.3%CVE-2026-48685MEDIUMFastNetMon Community Edition through 1.2.9 has out-of-bounds memory access because it incorrectly parses BGP path attributes with the extendEPSS 0.3%CVE-2026-9054CRITICALInvalid IP packets cause a kernel panicEPSS 0.3%CVE-2026-116013MEDIUMOpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response ParsingEPSS 0.3%CVE-2026-45681MEDIUMOpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB sizeEPSS 0.3%CVE-2026-41898HIGHrust-openssl: Unchecked callback-returned length in PSK and cookie generate trampolines can cause OpenSSL to leak adjacent memory to the network peerEPSS 0.3%