Fallos del tipo CWE-228

20 resultados

Tratamento inadequado de estruturas sintaticamente inválidas

O software não valida ou trata corretamente dados que violam o formato esperado — por exemplo, um JSON malformado, um pacote de rede truncado ou um arquivo com campos faltantes. Quando o código assume que a estrutura é válida sem verificar, pode causar exceções não tratadas, comportamento impredizível ou até execução de código arbitrário.

Ejemplo

Uma API recebe um JSON como entrada e tenta acessar diretamente um campo aninhado (ex: `data['user']['id']`) sem verificar se 'user' existe ou se o JSON é válido. Um atacante envia JSON malformado e a aplicação crashes ou expõe informações de erro sensíveis.

Cómo mitigar

Sempre validar e fazer parsing seguro: use schemas (JSON Schema, Protobuf), trate exceções de parse explicitamente, e implemente logs de erro sem expor detalhes internos. Rejeite dados que não se conformem à estrutura esperada antes de processar.

CVE-2018-5381MEDIUMThe Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgp_packet.c:bgpEPSS 30.2%CVE-2021-38443MEDIUMEclipse CycloneDDS Improper Handling of Syntactically Invalid StructureEPSS 2.1%CVE-2020-27847—A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allowEPSS 1.7%CVE-2021-36199MEDIUMVideoEdgeEPSS 1.0%CVE-2026-42100HIGHDoS in Sparx Pro Cloud ServerEPSS 0.7%CVE-2024-21612HIGHJunos OS Evolved: Specific TCP traffic causes OFP core and restart of REEPSS 0.5%CVE-2024-55594MEDIUMAn improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 EPSS 0.5%CVE-2026-34232HIGHFirebird: DoS via `op_response` packet from clientEPSS 0.5%CVE-2023-42784MEDIUMAn improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 aEPSS 0.4%CVE-2024-53828MEDIUMEricsson Packet Core Controller (PCC) - Improper Handling of Syntactically Invalid Structure VulnerabilityEPSS 0.4%CVE-2025-0343HIGHSwift ASN.1 can be caused to crash when parsing certain BER/DER constructions. This crash is caused by a confusion in the ASN.1 library itseEPSS 0.3%CVE-2026-20125HIGHA vulnerability in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE Software Release 3E could allow an authenticated, remote aEPSS 0.3%CVE-2024-6382MEDIUMAdversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands.EPSS 0.3%CVE-2024-22809MEDIUMIncorrect access control in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to access the G code's shared folder andEPSS 0.3%CVE-2025-47736LOWdialect/mod.rs in the libsql-sqlite3-parser crate through 0.13.0 before 14f422a for Rust can crash if the input is not valid UTF-8.EPSS 0.2%CVE-2024-22815MEDIUMAn issue in the communication protocol of Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of ServiEPSS 0.2%CVE-2025-2529LOWIBM Terracotta denial of serviceEPSS 0.2%CVE-2026-50103HIGHImproper Handling of Syntactically Invalid Structure in MZ Automation libIEC61850EPSS 0.2%CVE-2025-59174HIGHEricsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability where an attacker sending a large volume of specially cEPSS 0.2%CVE-2026-25657HIGHEricsson Packet Core Gateway (PCG) - Improper Handling of Syntactically Invalid Structure VulnerabilityEPSS 0.2%