Falhas do tipo CWE-754

507 resultados

Falta de validação de condições excepcionais

A fraqueza ocorre quando o software não valida ou valida incorretamente situações anômalas que raramente acontecem durante a operação normal. O desenvolvedor assume que certas condições 'nunca vão acontecer', deixando o código vulnerável quando elas de fato ocorrem — seja por entrada malformada, estado corrompido ou cenários edge case não previstos.

Exemplo

Um parser JSON que só testa o caminho feliz: carrega e processa um JSON válido, mas quando recebe um arquivo com caracteres especiais, tamanho excepcional ou estrutura quebrada, falha silenciosamente ou causa comportamento indefinido em vez de rejeitar explicitamente o entrada inválida.

Como mitigar

Sempre validar entradas e estados, não presumir cenários 'impossíveis': use try-catch, verificações de limites, e testes que explorem casos anormais (fuzzing, boundary testing). Falhe de forma segura e explícita — nunca em silêncio.

CVE-2026-0667CRITICALCWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service andEPSS 0.5%CVE-2022-3616MEDIUMOctoRPKI crash when maximum iterations number is reachedEPSS 0.5%CVE-2021-44856MEDIUMAn issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A title blocked by AbuseFilter can be crEPSS 0.5%CVE-2026-62334HIGHOpenVM's OpenVmHalo2Verifier self-call can bypass proof verificationEPSS 0.5%CVE-2026-77411CRITICALRabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstrEPSS 0.5%CVE-2026-48741HIGHlibIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoSEPSS 0.5%CVE-2024-30402HIGHJunos OS and Junos OS Evolved: The l2ald crashes on receiving telemetry messages from a specific subscriptionEPSS 0.5%CVE-2025-52981HIGHJunos OS: SRX Series: Sequence of specific PIM packets causes a flowd crashEPSS 0.5%CVE-2024-9124HIGHRockwell Automation PowerFlex 6000T CIP Security denial-of-service VulnerabilityEPSS 0.5%CVE-2022-41587MEDIUMUncaptured exceptions in the home screen module. Successful exploitation of this vulnerability may affect stability.EPSS 0.5%CVE-2023-44099—Vulnerability of data verification errors in the kernel module. Successful exploitation of this vulnerability may cause WLAN interruption.EPSS 0.5%CVE-2026-24054HIGHKata Containers Runtime: Host block device can be hotplugged to the VM if the container image is malformed or contains no layersEPSS 0.5%CVE-2023-5967MEDIUMDenial of Service via crashing the Calls PluginEPSS 0.5%CVE-2024-21603MEDIUMJunos OS: MX Series: Gathering statistics in a scaled SCU/DCU configuration will lead to a device crashEPSS 0.5%CVE-2026-73429MEDIUMRussh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)EPSS 0.5%CVE-2024-21586HIGHJunos OS: SRX Series and NFX Series: Specific valid traffic leads to a PFE crashEPSS 0.5%CVE-2026-19481HIGH@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part headerEPSS 0.5%CVE-2021-33139MEDIUMImproper conditions check in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.100 mayEPSS 0.5%CVE-2024-39545HIGHJunos OS: SRX Series, MX Series with SPC3 and NFX350: When VPN tunnels parameters are not configured in specific way the iked process will crashEPSS 0.5%CVE-2024-39540HIGHJunos OS: SRX Series, and MX Series with SPC3: Specific valid TCP traffic can cause a pfe crashEPSS 0.5%