Weaknesses of type CWE-1284

272 results

Validação inadequada da quantidade de dados em entrada

A aplicação não valida corretamente a quantidade, tamanho ou volume de dados que recebe do usuário, permitindo que entradas maiores ou menores que o esperado passem pelo controle. Isso abre espaço para ataques de negação de serviço, estouro de buffer, consumo excessivo de recursos ou processamento de dados malformados.

Example

Um serviço web aceita um parâmetro 'quantidade' para retornar registros, mas não limita o valor máximo. Um atacante envia quantidade=999999999, forçando a aplicação a alocar gigabytes de memória ou executar query que consome toda a CPU, derrubando o serviço para usuários legítimos.

How to mitigate

Implemente validação explícita para toda entrada numérica ou de tamanho: defina limites mínimos e máximos aceitáveis, rejeite silenciosamente o que sair desses intervalos e registre tentativas suspeitas. Use whitelist de valores válidos quando possível.

CVE-2022-31629MEDIUM$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilitiesEPSS 49.3%CVE-2025-9316MEDIUMN-central unauthenticated sessionID generationEPSS 36.3%CVE-2009-4488CRITICALVarnish 2.0.6 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window'sEPSS 12.8%CVE-2025-4365MEDIUMNetScaler Console and NetScaler SDX (SVM) - Arbitrary file readEPSS 8.3%CVE-2025-5349HIGHNetScaler ADC and NetScaler Gateway - Improper access control on the NetScaler Management InterfaceEPSS 4.3%CVE-2008-2374CRITICALsrc/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string lengtEPSS 4.3%CVE-2023-38709HIGHApache HTTP Server: HTTP response splittingEPSS 3.9%CVE-2013-0270MEDIUMKeystone: openstack keystone: denial of service via large http request with long tenant nameEPSS 3.1%CVE-2025-8424HIGHImproper access control on the NetScaler Management InterfaceEPSS 2.8%CVE-2024-6768MEDIUMDenial of Service in CLFS.sysEPSS 2.5%CVE-2026-23864HIGHMultiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, reacEPSS 2.4%CVE-2021-31346HIGHA vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions EPSS 1.9%CVE-2022-28199MEDIUMNVIDIA’s distribution of the Data Plane Development Kit (MLNX_DPDK) contains a vulnerability in the network stack, where error recovery is nEPSS 1.9%CVE-2026-49777CRITICALWordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerabilityEPSS 1.7%CVE-2021-31345HIGHA vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions EPSS 1.6%CVE-2020-27217—In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. In particEPSS 1.3%CVE-2026-58662HIGHApache Thrift: C++ THeaderTransport::readString() info-header length bounds bypassEPSS 1.1%CVE-2022-2592MEDIUMA lack of length validation in Snippet descriptions in GitLab CE/EE affecting all versions prior to 15.1.6, 15.2 prior to 15.2.4 and 15.3 prEPSS 1.1%CVE-2023-34188—The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload overEPSS 1.0%CVE-2023-30082HIGHA denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is suppliedEPSS 1.0%