Falhas do tipo CWE-440

41 resultados

Violação de Comportamento Esperado

É uma fraqueza genérica que descreve situações onde o software se comporta de forma diferente do que foi especificado ou esperado, causando falhas de segurança ou funcionalidade. Ocorre quando há desalinhamento entre o design/contrato do código e sua execução real, permitindo estados perigosos ou comportamentos não autorizados.

Exemplo

Um serviço de autenticação que deveria bloquear após 3 tentativas falhas, mas continua aceitando requisições porque a lógica de contadores foi bypassada em uma rota alternativa. Ou um módulo de validação de entrada que deveria rejeitar payloads maiores que X bytes, mas aceita se compactados, violando a expectativa de proteção.

Como mitigar

Defina especificações claras e formais do comportamento esperado em cada função crítica, implemente testes de conformidade (unit tests, integração) que validem o contrato e use code review para detectar desvios de lógica. Centralize validações e use princípios de fail-safe (falhar de forma segura por padrão).

CVE-2019-5108HIGHAn exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerabilitEPSS 10.1%CVE-2023-6129MEDIUMPOLY1305 MAC implementation corrupts vector registers on PowerPCEPSS 2.3%CVE-2021-41035—In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methEPSS 1.7%CVE-2018-12550—When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty, or contains only commeEPSS 1.4%CVE-2019-6569—The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into the mirrored network.EPSS 1.3%CVE-2023-2088MEDIUMA flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A rEPSS 1.2%CVE-2019-5061HIGHAn exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates fEPSS 0.9%CVE-2023-4807HIGHPOLY1305 MAC implementation corrupts XMM registers on WindowsEPSS 0.9%CVE-2024-56202MEDIUMApache Traffic Server: Expect header field can unreasonably retain resourceEPSS 0.8%CVE-2024-32971CRITICALDefect in query plan cache may cause incorrect operations to be executed in Apollo RouterEPSS 0.7%CVE-2022-3281HIGHWAGO: multiple products - Loss of MAC-Address-Filtering after rebootEPSS 0.7%CVE-2026-8806HIGHDenial-of-service (DoS) vulnerability in MELSEC iQ-F Series FX5-ENET/IP Ethernet moduleEPSS 0.6%CVE-2024-30246HIGHTuleap deleting or moving an artifact can delete values from unrelated artifactsEPSS 0.6%CVE-2026-42534MEDIUMJostle logic bypass degrades resolution performanceEPSS 0.6%CVE-2019-5062HIGHAn exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 80EPSS 0.5%CVE-2023-32732MEDIUMDenial-of-Service in gRPCEPSS 0.5%CVE-2023-32731HIGHInformation leak in gRPCEPSS 0.5%CVE-2025-46712LOWErlang/OTP SSH Has Strict KEX ViolationsEPSS 0.5%CVE-2020-10766MEDIUMA logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD. A bug in the logic handling allows an attacker withEPSS 0.5%CVE-2025-8850LOWInsecure API Design in danny-avila/librechatEPSS 0.4%