Falhas do tipo CWE-228

20 resultados

Tratamento inadequado de estrutura sintaticamente inválida

É quando o código recebe dados estruturados (JSON, XML, protobuf, etc.) malformados ou que violam o esquema esperado, mas não valida ou trata o erro de forma robusta. O programa pode falhar, processar dados incorretos, ou deixar passar entradas perigosas porque assume que a estrutura é válida.

Exemplo

Um parser de JSON que tenta acessar um campo aninhado sem verificar se o objeto pai existe ou tem o tipo certo; se a estrutura vier mal formatada, pode gerar exceção não tratada, corrupção de estado, ou até injeção de lógica maliciosa através de campos inesperados.

Como mitigar

Sempre validar a estrutura antes de usar: verificar tipos, campos obrigatórios, limites de tamanho e aninhamento. Use parsers que falhem explicitamente em dados inválidos (reject invalid), e implemente tratamento de exceção adequado. Em entrada não confiável, rejeite ou normalize conforme um schema rigoroso.

CVE-2018-5381MEDIUMThe Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgp_packet.c:bgpEPSS 30.2%CVE-2021-38443MEDIUMEclipse CycloneDDS Improper Handling of Syntactically Invalid StructureEPSS 2.1%CVE-2020-27847—A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allowEPSS 1.7%CVE-2021-36199MEDIUMVideoEdgeEPSS 1.0%CVE-2026-42100HIGHDoS in Sparx Pro Cloud ServerEPSS 0.7%CVE-2024-21612HIGHJunos OS Evolved: Specific TCP traffic causes OFP core and restart of REEPSS 0.5%CVE-2024-55594MEDIUMAn improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 EPSS 0.5%CVE-2026-34232HIGHFirebird: DoS via `op_response` packet from clientEPSS 0.5%CVE-2023-42784MEDIUMAn improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 aEPSS 0.4%CVE-2024-53828MEDIUMEricsson Packet Core Controller (PCC) - Improper Handling of Syntactically Invalid Structure VulnerabilityEPSS 0.4%CVE-2025-0343HIGHSwift ASN.1 can be caused to crash when parsing certain BER/DER constructions. This crash is caused by a confusion in the ASN.1 library itseEPSS 0.3%CVE-2026-20125HIGHA vulnerability in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE Software Release 3E could allow an authenticated, remote aEPSS 0.3%CVE-2024-6382MEDIUMAdversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands.EPSS 0.3%CVE-2024-22809MEDIUMIncorrect access control in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to access the G code's shared folder andEPSS 0.3%CVE-2025-47736LOWdialect/mod.rs in the libsql-sqlite3-parser crate through 0.13.0 before 14f422a for Rust can crash if the input is not valid UTF-8.EPSS 0.2%CVE-2024-22815MEDIUMAn issue in the communication protocol of Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of ServiEPSS 0.2%CVE-2025-2529LOWIBM Terracotta denial of serviceEPSS 0.2%CVE-2026-50103HIGHImproper Handling of Syntactically Invalid Structure in MZ Automation libIEC61850EPSS 0.2%CVE-2025-59174HIGHEricsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability where an attacker sending a large volume of specially cEPSS 0.2%CVE-2026-25657HIGHEricsson Packet Core Gateway (PCG) - Improper Handling of Syntactically Invalid Structure VulnerabilityEPSS 0.2%