Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
When discarding an oversized packet payload, returning a positive packet length rather than an error status causes callers to treat uninitialized buffer memory as valid packet data, leading to out-of-bounds reads.
Base64 decoding error is ignored by checking `err == nil` for assignment. If the input is invalid base64, decoding fails silently and the code falls back to raw or default key bytes without error handling.
Creating a libpng read structure with NULL error handlers and without setjmp error recovery causes libpng to execute its default error handler (abort()) on malformed PNG files, causing a process crash.
A fail-open condition was detected where an exception during identifier enquoting, escaping, or validation results in the method returning the raw, unescaped input. This logic bypasses the intended escaping mechanism and leads to secondary Injection vulnerabilities (e.g., SQL Injection) if the attacker provides malicious input designed specifically to trigge
Base64 decoding error is silently swallowed when processing input. If base64 decoding fails, execution continues without error handling, potentially using unvalidated raw string data as a key or payload. Check `if err != nil` and handle or return the decoding error explicitly.
Returning a non-nil Auth object alongside a non-nil error in a response handler can cause caller handlers to create orphaned tokens or process invalid authentication state.
Unchecked type assertion to a cryptographic key type (e.g., `*rsa.PublicKey`). If the interface contains a different type (for instance, an ECDSA key returned by an external JWKS endpoint instead of RSA), the assertion will panic and cause a Denial of Service. Use the `value, ok := ...` idiom to safely assert types.
Silently skipping malformed PAX extensions by using `filter_map(|f| f.ok())` can conceal parsing errors and lead to parser differentials. This behavior can be exploited if a subsequent component interprets the skipped malformed extension differently. Propagate the error using `?` or handle it explicitly instead of suppressing it.
Using `assert` for critical data validation or state checks (such as end-of-file boundaries, stream validation, or field presence) is unsafe. When Python is executed with optimizations enabled (`-O` or `PYTHONOPTIMIZE=1`), all `assert` statements are stripped. This allows malformed data to bypass checks entirely, potentially leading to infinite loops or Deni
