Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
A buffer growth routine exponentially increases buffer capacity without checking against a maximum decoded size limit. This may allow decompression bombs or oversized stream inputs to exhaust system memory and cause a denial of service.
Calling `Task.yield/2` with a 0ms timeout performs a non-blocking check. When executed in a loop or recursive polling function without blocking or sleeping, it causes busy-spinning that exhausts BEAM scheduler CPU resources. Use `Task.yield_many/2` with a blocking timeout or an appropriate synchronization mechanism.
Formatting git log output as raw XML tags with git placeholders and parsing it with SimpleXMLElement can lead to denial of service or parsing failures if commit messages or metadata contain XML special characters or CDATA delimiters.
Repeatedly concatenating stream reads to an immutable `bytes` object inside a loop causes quadratic O(N^2) time complexity and excessive memory allocation. Use `bytearray` or a list of chunks instead.
`parse_qs_bytes` is invoked without specifying `max_num_fields`. Parsing URL-encoded bodies or query strings without a field count limit allows an attacker to send payloads with millions of parameters, blocking Tornado's event loop and causing a Denial of Service (CVE-2026-82397). Pass `max_num_fields` to bound parameter parsing.
Argon2 KDF cost parameters (such as memory_cost) are passed directly to key derivation without prior upper-bound validation. If derived from untrusted files or configuration, an excessively high memory_cost can lead to an out-of-memory denial of service.
WebSocket framing or decompression logic lacks upper bound checks on message/buffer sizes.
Unbounded string splitting on '.' when parsing compact JWE/JWS/JWT tokens can allow a remote attacker to trigger excessive memory allocation (MemoryError DoS) by providing numerous delimiter characters. Specify a maxsplit argument to split (e.g., `split('.', 5)`).
Untrusted input passed to language.ParseAcceptLanguage or go-i18n NewLocalizer without validating length or separator counts ('-' and '_') can trigger quadratic-time parsing and cause denial of service (CVE-2026-79658).
Appending to a list accumulator using `++` inside `Enum.reduce` causes quadratic copying (O(N^2)), which can lead to denial of service via high CPU and memory usage on large inputs. Prepend elements using `[elem | acc]` and reverse the list afterwards with `Enum.reverse/1`.
STIX 2 content is read and parsed without prior input size validation, potentially leading to memory exhaustion and denial of service.
An event listener is registered unconditionally on an object's signal after a conditional check that reuses existing instances. When refreshing an existing cached entry, this repeatedly registers listeners on the reused signal, leading to memory leaks and denial of service.
The route handler contains a polling loop with sleep() that lacks a timeout or maximum duration check. An attacker can supply parameters that prevent the loop exit condition from triggering, causing worker threads or connections to block indefinitely and exhausting server resources.
Using `collections.deque(f, maxlen=...)` on an opened file object reads the entire file sequentially from the beginning. On large files, this causes uncontrolled CPU and disk I/O consumption (CWE-400). Use backward-seeking from the end of the file instead.
Cloning the entire active namespace or scope map from the top of a stack on each element push creates quadratic (O(N^2)) memory and CPU overhead during nested parsing, potentially leading to denial of service (OutOfMemoryError). Use an undo/delta log or persistent data structure instead of cloning the entire map per scope.
Unbounded decompression using `zlib.decompress()` can lead to excessive memory consumption and denial of service (decompression bomb / zip bomb). Use `zlib.decompressobj().decompress(..., max_length)` to enforce an upper bound on the decompressed output size.
Breaking out of the zero-copy Tx batch loop upon encountering an invalid descriptor without draining multi-buffer fragments or reclaiming invalid descriptors causes descriptor leakage and ring desynchronization.
Helidon serialization configuration should use MetadataDiscovery rather than direct ClassLoader lookup to ensure complete filter discovery.
ClassLoader resource lookup for serialization configuration files may miss configuration entries in single-jar and modular deployments, leading to incomplete deserialization filter enforcement.
A deferred Promise is created with only a `resolve` handler and stored into a tracking collection or map. If the corresponding HTTP request or WebSocket handshake fails or aborts, the Promise will remain pending indefinitely and the request object in the map will not be cleaned up, leading to memory leaks and DoS.
Fee sponsorship validates transaction economics per individual transaction without reserving in-flight aggregate budget, allowing concurrent requests to drain the fee-payer wallet.
WebSocket frame aggregator instantiated without specifying a maximum aggregate message size limit. Unbounded aggregation of continuation frames can lead to OutOfMemoryError and denial of service.
Checking string length against 'six.text_type' instead of 'six.string_types' allows byte strings to bypass length limits under Python 2, potentially leading to DoS.
Quota or bandwidth usage counters are decremented before checking if a session is mobile or suspended. This prematurely releases quota counters while session resources remain active, allowing quota enforcement bypass.
