Rule Explorer

JPEG 2000 SIZ marker parsing does not validate tile and image geometry, which can lead to out-of-bounds writes during block decoding.

C++CVE-2026-68516CWE-1284CWE-787

A boundary check only validates the upper bound of a slice but fails to check for negative indices. If the index can be user-controlled, this can lead to an out-of-bounds panic. Ensure you also check that the index is >= 0.

GoCVE-2026-59162CWE-125CWE-1284

A UFS image parser validates fields like block size or fragment count against a lower root limit but fails to enforce an upper bound or proper structural consistency. Attackers can control descriptor inputs to provoke uncontrolled huge memory allocations, causing DoS or process termination.

C++CVE-2026-55781CWE-1284CWE-400

Variable-length integers are accumulated from an input stream without validation. An attacker can send an endless stream of crafted bytes to cause a Denial of Service (DoS) via memory exhaustion as the integer grows iteratively. Ensure that the accumulated length is checked against a maximum limit immediately during parsing.

RubyCVE-2026-54463CWE-1284CWE-400

Missing validation that length-delimited field length is non-negative before skipping. A crafted protobuf message with a negative payload length can crash the parser or corrupt internal position state, causing Denial of Service (DoS).

KotlinCVE-2026-45799CWE-1284CWE-130

Password callback FFI trampoline forwards the user closure's returned `usize` length to OpenSSL as `c_int` without checking that it does not exceed the buffer `size` parameter that OpenSSL passed in. A user closure that returns a value larger than `size` (e.g. mistaking the length of an external secret for the number of bytes written) causes OpenSSL 1.1.x /

RustCVE-2026-41677GHSA-XMGF-HQ76-4VX2CWE-125CWE-1284

Validation of `Vec<String>` argument length uses `> 2` instead of `>= 2` before extracting an element at index 1. This off-by-one error causes the argument to be skipped entirely when exactly 2 items are present (the command and a single argument), potentially leading to logic bypass or argument type confusion.

RustCVE-2026-35369CWE-1284CWE-754

Unpacking multiple logical parameters from a single Gin path variable using `strings.Split` can lead to parameter confusion and input validation boundaries bypass. If a user-controlled item (like an ID) naturally contains the delimiter, subsequent array offsets map incorrectly, potentially leading to logic corruption, IDOR, or errors. To resolve this securel

GoCVE-2026-32937CWE-1284CWE-20

Archive entry sizing must account for PAX extended headers to prevent archive entry smuggling (CWE-130 / CWE-1284). Relying exclusively on the basic ustar header size allows an attacker to specify a falsely small size, causing the parser to prematurely conclude the file read and misinterpret remaining file data as injected tar entry headers. Ensure PAX exten

RustCVE-2025-62518CWE-130

A byte count is padded to a block size using `divmod` without validating if the count is negative. In Python, `divmod` with a negative dividend and positive divisor yields a negative quotient. This can result in negative padded lengths that propagate into file offsets or buffer sizes, potentially leading to backwards-seeking pointer errors, infinite loops, o

PythonCVE-2025-8194CWE-1284CWE-835

A boundary check on a max size or limit configuration uses strict equality (`== 0`) to apply a default value. This validation fails to account for negative configuration values. When negative sizes bypass initialization and are passed to parsing or decompression libraries, it can bypass their internal zero-value checks and lead to unrestricted memory allocat

GoCVE-2024-36129CWE-1284CWE-400

The application splits a string using a delimiter and accesses the first or last character (e.g., `[0]` or `[-1]`) of the resulting element without checking if it is non-empty. If the input string begins with the delimiter, the first element will be an empty string, leading to an `IndexError`. This can cause unhandled exceptions and Denial of Service (DoS) w

PythonCVE-2024-23829CWE-1284CWE-754