Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
FFI trampoline forwards a Rust closure's returned `usize` length directly to OpenSSL (cast to `c_uint`/`size_t`/`u32`) without first comparing it against the length of the `&mut [u8]` slice that was handed to the closure. A buggy or attacker-influenced closure can return a length larger than the slice, causing OpenSSL to read past the buffer and serialize ad
A chunk discard path in the push-mode parser clears the PNG_HAVE_CHUNK_HEADER state without calling png_crc_finish() or consuming the chunk payload. This leaves raw unconsumed bytes in the stream, parsing them as a new chunk on the next iteration and enabling chunk smuggling. Ensure the chunk body and CRC are consumed before clearing the state flag.
A pointer returned by a custom offset-based extractor function is mapped and dereferenced in a loop without a validation boundary for NULL. This can lead to a NULL pointer dereference.
A state object's dimensions (width/height) are updated before a memory allocation loop that could fail and exit. If an allocation fails, the function returns early and leaves the context dimensions inflated for a smaller buffer. This inconsistency can lead to out-of-bounds memory accesses. Update object dimensional properties only after validating that memor
The authentication tag for AES-GCM decryption is extracted using `substr` but its length is not validated. If an attacker provides a short payload, `substr` may return a truncated tag which `openssl_decrypt` accepts, allowing brute-force attacks to recover the GHASH key and forge ciphertexts. Verify the tag length using `strlen` before passing it to `openssl
Archive entry sizing must account for PAX extended headers to prevent archive entry smuggling (CWE-130 / CWE-1284). Relying exclusively on the basic ustar header size allows an attacker to specify a falsely small size, causing the parser to prematurely conclude the file read and misinterpret remaining file data as injected tar entry headers. Ensure PAX exten
An element is removed from a stack/collection and discarded or not validated before the remaining collection is validated for size limits. If the collection is subject to policy limits, the discarded element may bypass these limits, leading to denial of service through resource exhaustion. Extract the element and enforce a length check.
Limiting macro or token expansion depth using a simple step increment rather than accounting for the actual size of the instantiated tokens fails to prevent exponential string/array blowup, leading to DoS. Ensure size-based quotas are actively calculated and subtracted.
