Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Session pointer obtained from `tee_ta_get_session` is used in `tee_ta_invoke_command` without checking if it is NULL. An invalid or unallocated session ID can result in a NULL pointer dereference and DoS.
Directly accessing `ExpiresAt.Time` on JWT claims without checking if `ExpiresAt` is nil causes a nil pointer dereference panic for tokens without an expiration (`exp`) claim. This can crash revocation and logout handlers, allowing tokens to remain valid.
Unvalidated Visited-PLMN-Id AVP data pointer and length passed directly to ogs_auc_kasme. A Diameter request with a missing or truncated Visited-PLMN-Id AVP can cause out-of-bounds memory access or null pointer dereference. Validate the AVP length against OGS_PLMN_ID_LEN and copy to a validated buffer before calling ogs_auc_kasme.
Accessing RequestError.Parameter fields without checking if Parameter is nil can cause a nil-pointer dereference panic when handling request-body validation errors.
Directly accessing `Schema.Value` on an OpenAPI media type without checking if `Schema` is nil can trigger a nil-pointer dereference panic if a request specifies a media type without a schema.
X509_ALGOR_get0 was called to extract algorithm parameters, but the parameter pointer was checked for NULL without validating the ASN.1 parameter type. This can lead to a NULL pointer dereference or invalid memory access if an unexpected ASN.1 type is supplied.
A nested pointer or interface field within the NATS connection structure is accessed without a prior nil check, which can lead to a runtime panic. Ensure that connection objects like `c.acc` and `c.leaf.remote` are validated before dereferencing them.
Kafka tombstone records deliberately carry a `null` value in their message body. When this `null` value is passed directly as the constructor argument for buffer wrappers like `ReadOnlySequence`, `Memory`, `ReadOnlyMemory`, or `MemoryStream` without a check, an `ArgumentNullException` is thrown. In the context of a message processing loop, completely unhandl
Missing NULL check on OS_StrBreak result or its array elements prior to usage, potentially causing a NULL pointer dereference (CWE-476).
Potential NULL pointer dereference. The boolean condition allows a path where `$VAR` is NULL but is passed to `sessionBindValue`. Ensure `$VAR` is strictly checked for NULL before being passed to `sessionBindValue`.
Envoy is vulnerable to a null pointer dereference when handling HTTP 303 (See Other) internal redirects for body-less non-GET/HEAD requests. The router unconditionally attempts to drain the request body decoding buffer, which is never allocated for requests without a body. This leads to a denial of service crash. Checking if the decoding buffer exists is req
The result of `strtok` or `strtok_r` is used as an iterator in a `do-while` loop without a prior `NULL` check. If the input string consists entirely of delimiters, the tokenizer will return `NULL`, causing a `NULL` pointer dereference on the first loop iteration. Use a `while` loop or add a `NULL` check prior to the `do-while` block.
Conditionally skipping the initialization function leaves state uninitialized, causing downstream nil pointer dereferences.
'$RESP.$FIELD' is accessed before '$RESP' is nil-checked. When the upstream call returns nil (for example on a 404 or transport error), this dereference causes a nil pointer dereference panic (CWE-476). Move the field access '$X = $RESP.$FIELD' to after the nil/error guard block so that it only executes when '$RESP' is confirmed non-nil.
`getNearCacheStats()` returns a `@Nullable` object. Dereferencing it directly without a null check or `Objects.requireNonNull` can lead to NullPointerException, especially in delayed execution contexts like metric gauge callbacks where the state may have changed since registration.
The pointer returned by dw_get_dname() is passed to dwc_lower_case() BEFORE it is checked for NULL. If dw_get_dname() fails (for example, when parsing a malformed CNAME referral with embedded NULL bytes in a label), it returns NULL and dwc_lower_case() will dereference a NULL pointer. The NULL check on the result must be performed BEFORE calling dwc_lower_ca
A pointer returned by a custom offset-based extractor function is mapped and dereferenced in a loop without a validation boundary for NULL. This can lead to a NULL pointer dereference.
An EXIF IFD index extracted via `atoi` is not validated before usage. An attacker can supply an out-of-bounds IFD index in EXIF metadata, potentially leading to a null pointer dereference or out-of-bounds memory access deep inside EXIF decoding libraries. Ensure the result of `atoi` is bounds-checked (e.g., against the expected maximum IFD count) immediately
Potential null pointer dereference due to skipping object initialization for 6 or fewer channels. Ensure that necessary components are allocated regardless of channel count or properly handled otherwise.
A libnuma allocation function is called without a subsequent NULL check. This can lead to a NULL pointer dereference or memory leak if memory exhaustion occurs. Always properly check and handle the returned pointer.
Missing NULL check on the result of `strchr` or `strrchr` before using it in string/memory operations. This can lead to a NULL pointer dereference if the character is not found.
Ignoring the error returned by URL parsing functions (like `url.Parse` or `url.ParseRequestURI`) using the blank identifier `_` can lead to nil pointer dereferences. If the dynamically generated input is invalid, the resulting URL object is nil. Dereferencing it will cause a panic (Denial of Service). Ensure that the error is explicitly checked and handled.
The return value of `cram_decode_compression_header()` is used without being checked for NULL. A malformed CRAM file may cause this function to return NULL, leading to a NULL pointer dereference when passed to other functions. Ensure the return value is checked before use.
Time-of-Check to Time-of-Use (TOCTOU) data race detected. A structure field is checked for NULL and then dereferenced. In multithreaded environments, another thread can nullify or free the pointer between the check and the dereference, causing a NULL pointer dereference. Either cache the pointer in a local variable or wrap the check and use securely within a
