Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Multimodal input validator rejects a present tensor because its reduced pixel sum is zero ($COND). Normalized image pixels can legitimately sum to exactly 0 (e.g. an image that is half black and half white under Normalize(0.5, 0.5)), so this shortcut discards a legal input, makes embed_multimodal() return no embeddings for an encoder step that still carries
A client-supplied stmtIds array is accepted here after only a length check (and stmtId/stmtIds mutual exclusion); its values are never checked for uniqueness or non-negativity. Duplicate or negative statement IDs violate the retryable-write/applyOps bookkeeping invariant, which is only enforced later by fatal assertions - the resulting crash state can be dur
Internal expression '_internalIndexKey' is registered without restricting client access to internal cluster nodes, allowing external clients to trigger an assertion failure DoS.
Using assert() for bounds checking before memcpy() can lead to buffer overflow when NDEBUG is defined, or denial of service when untrusted inputs trigger an abort. Use explicit runtime boundary checks instead.
Using assert() to validate the quantization style bits (Sqcd & 0x1F) in JPEG2000/HTJ2K codestreams causes an unconditional process crash (DoS) on malformed input. Use runtime validation with error handling instead.
A size or length value read from an external source is passed directly to `resize()` on a container without validating it against maximum limits or available stream size. This can lead to excessive memory allocation, bad_alloc exceptions, reachable assertions, or denial of service.
A QUIC CRYPTO stream may be incorrectly subjected to standard stream flow control. CRYPTO streams use negative stream IDs and lack standard flow control windows; invoking flow control on them triggers an assertion failure (Denial of Service). Ensure `stream->stream_id >= 0` is checked before invoking flow control functions.
$LOGGER.$FATAL(...) inside a goroutine calls os.Exit(1) after logging, which immediately terminates the entire process — even when the goroutine contains a defer/recover handler. This turns any transient error (e.g., an unreachable callback URI) into a process-level crash that cannot be caught by the caller. Replace with a non-fatal method such as Errorf or
Inverted bounds assertion before AES_unwrap_key: the guard `OUT.len() + 8 <= IN.len()` is reversed. AES key unwrap (RFC 3394) writes `IN.len() - 8` bytes into `OUT`, so the correct invariant is `OUT.len() + 8 >= IN.len()` (equivalently `OUT.len() >= IN.len() - 8`). The reversed comparison admits undersized output buffers and causes an out-of-bounds write fro
Using `assert` for string validation before usage is vulnerable to a bypass because Python strips assert statements from bytecode when executed with optimizations (`-O`). Attackers can supply inputs that bypass string-prefix boundaries, potentially leading to arbitrary code execution, unintended module loading, or path traversal. Replace the `assert` stateme
Using `panic!` inside libp2p `ConnectionHandler` negotiation events (`FullyNegotiatedInbound`, `FullyNegotiatedOutbound`) exposes the application to remote Denial of Service (DoS) attacks. An attacker can intentionally negotiate duplicate streams or unexpected states to trigger the panic and crash the node. Handle invalid states gracefully by returning an er
Using `.expect()` or `.unwrap()` on the result of a checked arithmetic operation (e.g., `checked_add`, `checked_sub`) causes a runtime panic on overflow/underflow. When processing untrusted input, this leads to Denial of Service (DoS) due to reachable assertions. Handle the error gracefully using `.ok_or(...)?` or a `match` statement.
Length validation performed via assert() is disabled in production/release builds, which may cause integer underflows or buffer overflows during subsequent size calculations. Use runtime error checking (e.g., if (...) return ...) instead.
A client-supplied authentication mechanism is forwarded unvalidated into a protocol request ($REQ.setMechanism($MECH)) and single-step protocol completion is enforced with a non-catchable fatal assertion (invariant(...getDone()...)). Because the authenticate command is reachable without authentication, a client can name any mechanism enabled on the server (e
Using `assert` for critical data validation or state checks (such as end-of-file boundaries, stream validation, or field presence) is unsafe. When Python is executed with optimizations enabled (`-O` or `PYTHONOPTIMIZE=1`), all `assert` statements are stripped. This allows malformed data to bypass checks entirely, potentially leading to infinite loops or Deni
The code asserts that two object fields are null (indicating an uninitialized or free state), and then subsequently assigns to one of them. If the execution path reaching this assertion can be triggered multiple times via external input, the assertion will fail and crash the application (Denial of Service). Replace this assertion with proper conditional logi
Failing to drop Initial encryption keys prior to or while dropping Handshake keys can lead to an assertion failure and Denial of Service (DoS). A malicious server might prematurely confirm the handshake (e.g., by sending a HANDSHAKE_DONE frame early), leaving unexpected Initial keys in the state. Ensure `protocol.EncryptionInitial` keys are explicitly droppe
Validating cluster paths using `Ember::ValidateClusterPath` within `Invoke` methods at the DataModelProvider layer is structurally insufficient and can lead to a reachable assertion (CVE-2025-56365) in `ProcessCommandDataIB` when invalid endpoints are processed. The validation check has been shifted to the caller to ensure invalid endpoints are securely reje
Debug assertions (`DCHECK`, `assert`) are compiled out in release builds (e.g., when NDEBUG is defined). Using them exclusively for bounds checking discards the safety guarantee, potentially enabling memory corruption vulnerabilities if out-of-bounds data is processed. Enforce bounds limits using `CHECK`, exceptions, or standard conditional validation that p
Missing handler for OGS_SBI_SERVICE_NAME_NPCF_AM_POLICY_CONTROL in the gmm_state_authentication function. An unexpected AM Policy Control response causes the AMF to hit a DEFAULT case that invokes ogs_assert_if_reached(), leading to a Denial of Service.
