Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Pydantic request model $MODEL declares range-geometry fields (offset / start / index / position, length / size) as plain `int` with no `Field(ge=...)` / `Field(gt=...)` constraint. When this schema validates remote request bodies, a client can supply negative offsets or zero/negative lengths that slip past downstream arithmetic bounds checks (Python negative
Key-material validator $CHECK_KEY() rejects malformed key formats (key material containing unsafe PEM/SSH markers) but never rejects empty key material. HMAC with a zero-length key is deterministic and publicly computable, so a secret that resolves to "" or b"" (missing/unset configuration, a JWK {"kty":"oct","k":""}, or a key callable returning "") lets an
This octal field decoder accumulates bytes with `$V = $V * 8 + ($C - 48)` without first checking that each byte is an ASCII octal digit ('0'-'7' == 48-55). Bytes outside that range (e.g. '/', '8', '9', ':') are silently folded into the parsed number, so an attacker-supplied header field (such as a tar entry size) can decode to an attacker-influenced wrong va
A row number parsed from an untrusted worksheet XML attribute is written into the iterator's current-row state under a plain "$ROW != 0" guard, with no upper-bound check against the maximum row limit. A crafted worksheet that places an oversized row number after a valid row makes the iterator jump to the attacker-chosen row index and advance through every mi
Client-supplied token id list `$IDS` is validated only by type (`isinstance(..., int)`), with no range check against the model vocabulary. Stop-token ids are used as column indices into the vocab-wide logits tensor (min-tokens stop-token suppression logits processor; CUDA `index_put_` / subscript write). An id that is negative or >= vocab_size reaches that d
$FUNC short-circuits on the skip flag `$SKIP` without scoping the skip to the role it was meant to exempt (`$ROLE`). The early return is guarded by the bare flag alone, so it suppresses every later check in $FUNC, including the validation keyed on the role discriminator, and inputs of the still-regulated role reach the engine unvalidated. Scope the early ret
Range validation of caller-supplied id sequence $IDS only rejects values above an upper limit (max($IDS) > limit) and never rejects negative values. A negative id passes validation and is later used as an index (e.g. an embedding-table row); on GPU backends the out-of-range index raises a device-side assertion that poisons the accelerator context and fails e
Buffer boundary check uses a signed integer length without verifying that it is non-negative, which can allow negative lengths to pass and cause memory corruption or unhandled exceptions.
A length prefix is read from an untrusted byte stream with encoding/binary.Read into a signed integer and passed to make() without checking that it is non-negative. Attacker controlled bytes with the sign bit set (e.g. 0xFFFFFFFF) decode to a negative int (e.g. -1), and make() panics with "len out of range". The panic is unrecovered on the network reader gor
The negotiated AMQP 0-9-1 frame size is taken straight from the peer-advertised connection.tune frame-max value (a bare pick()/min() selection, a numeric conversion, or a direct assignment) and stored into the connection frame-size configuration without ever enforcing the protocol minimum frame size (frameMinSize, 4096 bytes). A malicious or compromised brok
Inbound frame/size limit is computed with Math.min(configuredCap, negotiatedFrameMax) and handed directly to the framing layer. In AMQP 0-9-1 a negotiated limit of 0 is a sentinel meaning "no limit" (and the client default frame_max is 0), so Math.min returns 0 whenever the peer - a malicious broker or a MitM - negotiates frame_max=0. The framing layer then
Clamping negative byte sizes to zero instead of rejecting invalid ranges with an error can allow 32-bit signed integer overflow to corrupt buffer pool offsets.
Unbounded string passed to list_to_integer/1 can lead to excessive CPU consumption (DoS) when processing arbitrary-precision integers. Validate the string length before conversion.
JPEG 2000 SIZ marker parsing does not validate tile and image geometry, which can lead to out-of-bounds writes during block decoding.
Unbounded port-to-integer conversion (availability/DoS). This clause belongs to a port-parsing function (clause-head name ends in `port`) and its body immediately converts a bare input variable with binary_to_integer/1 or list_to_integer/1 while the clause head carries no size guard, so a grammar-valid all-digit port field (RFC 3986 `port = *DIGIT`) of arbit
A UFS image parser validates fields like block size or fragment count against a lower root limit but fails to enforce an upper bound or proper structural consistency. Attackers can control descriptor inputs to provoke uncontrolled huge memory allocations, causing DoS or process termination.
Length $LEN is decoded from a wire/network buffer with a network-to-host conversion and is validated only against a lower bound. Without an upper-bound check before $LEN is folded into the packet/allocation-size arithmetic, an attacker-supplied huge length can make the size addition wrap, producing an undersized allocation and a heap out-of-bounds write when
Variable-length integers are accumulated from an input stream without validation. An attacker can send an endless stream of crafted bytes to cause a Denial of Service (DoS) via memory exhaustion as the integer grows iteratively. Ensure that the accumulated length is checked against a maximum limit immediately during parsing.
A size or length value read from an external source is passed directly to `resize()` on a container without validating it against maximum limits or available stream size. This can lead to excessive memory allocation, bad_alloc exceptions, reachable assertions, or denial of service.
A count decoded from untrusted input ($N) sizes a collection via Vec::with_capacity/String::with_capacity without first being validated against the data actually available in the input. A malicious peer can send an inflated count (e.g. u32::MAX) in a single short packet, making the process request an enormous allocation whose failure aborts the process (remo
Missing validation that length-delimited field length is non-negative before skipping. A crafted protobuf message with a negative payload length can crash the parser or corrupt internal position state, causing Denial of Service (DoS).
Password callback FFI trampoline forwards the user closure's returned `usize` length to OpenSSL as `c_int` without checking that it does not exceed the buffer `size` parameter that OpenSSL passed in. A user closure that returns a value larger than `size` (e.g. mistaking the length of an external secret for the number of bytes written) causes OpenSSL 1.1.x /
Validation of `Vec<String>` argument length uses `> 2` instead of `>= 2` before extracting an element at index 1. This off-by-one error causes the argument to be skipped entirely when exactly 2 items are present (the command and a single argument), potentially leading to logic bypass or argument type confusion.
A 4-byte wire-protocol length/count is read with binary.BigEndian.Uint32(...) and only widened with plain int(...) before it is used as a slice bound ($BUF[$X : $X + $N], $BUF[$N:] or $BUF[:$N]). Unsigned widening makes the value never negative, so the protocol's -1 NULL sentinel check can never match the real NULL encoding (0xFFFFFFFF) and no negative-lengt
