Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
A buffer growth routine exponentially increases buffer capacity without checking against a maximum decoded size limit. This may allow decompression bombs or oversized stream inputs to exhaust system memory and cause a denial of service.
`parse_qs_bytes` is invoked without specifying `max_num_fields`. Parsing URL-encoded bodies or query strings without a field count limit allows an attacker to send payloads with millions of parameters, blocking Tornado's event loop and causing a Denial of Service (CVE-2026-82397). Pass `max_num_fields` to bound parameter parsing.
Argon2 KDF cost parameters (such as memory_cost) are passed directly to key derivation without prior upper-bound validation. If derived from untrusted files or configuration, an excessively high memory_cost can lead to an out-of-memory denial of service.
Envelope decryption recovery slots from untrusted metadata are processed without validating against a maximum slot count limit. An attacker can supply a crafted file with numerous recovery slots to cause pre-authentication CPU and memory exhaustion (DoS).
WebSocket framing or decompression logic lacks upper bound checks on message/buffer sizes.
STIX 2 content is read and parsed without prior input size validation, potentially leading to memory exhaustion and denial of service.
An event listener is registered unconditionally on an object's signal after a conditional check that reuses existing instances. When refreshing an existing cached entry, this repeatedly registers listeners on the reused signal, leading to memory leaks and denial of service.
Cloning the entire active namespace or scope map from the top of a stack on each element push creates quadratic (O(N^2)) memory and CPU overhead during nested parsing, potentially leading to denial of service (OutOfMemoryError). Use an undo/delta log or persistent data structure instead of cloning the entire map per scope.
Breaking out of the zero-copy Tx batch loop upon encountering an invalid descriptor without draining multi-buffer fragments or reclaiming invalid descriptors causes descriptor leakage and ring desynchronization.
A deferred Promise is created with only a `resolve` handler and stored into a tracking collection or map. If the corresponding HTTP request or WebSocket handshake fails or aborts, the Promise will remain pending indefinitely and the request object in the map will not be cleaned up, leading to memory leaks and DoS.
Fee sponsorship validates transaction economics per individual transaction without reserving in-flight aggregate budget, allowing concurrent requests to drain the fee-payer wallet.
WebSocket frame aggregator instantiated without specifying a maximum aggregate message size limit. Unbounded aggregation of continuation frames can lead to OutOfMemoryError and denial of service.
Quota or bandwidth usage counters are decremented before checking if a session is mobile or suspended. This prematurely releases quota counters while session resources remain active, allowing quota enforcement bypass.
Apache HTTP Server configuration does not define RequestReadTimeout directives, leaving endpoints susceptible to slowloris and resource exhaustion denial of service.
In-memory cache uses an unbounded plain JavaScript object with dynamic key assignments and no size limit or eviction policy. If populated with dynamic inputs, this can cause unbounded memory growth and process crash (DoS).
HTTP request body is copied directly to a destination writer without enforcing a maximum length bound. This can allow oversized uploads to exhaust disk space or memory. Use 'io.LimitReader', 'io.CopyN', or 'http.MaxBytesReader' to enforce upload limits.
Unconstrained range expansion detected in dictionary comprehension. When range parameters are parsed from external data, constructing ranges without validating length or maximum entry limits can result in denial of service through high memory and CPU consumption.
Direct call to `MapConstructor.construct` during protocol decoding bypasses `ValueHandler` nested object tracking and parser safety limits. Use `ValueHandler.parseMapWithConstructor` instead.
Granting Bash tool execution privileges (`Bash(...)`) to `anthropics/claude-code-action` in workflows handling untrusted pull request inputs allows arbitrary shell command execution via prompt injection and shell command chaining.
Converting dynamic or user-controlled input into atoms using 'String.to_atom' can lead to atom table exhaustion and crash the Erlang VM (BEAM). Use 'String.to_existing_atom' with error handling instead.
The application decodes an image without first validating its dimensions using `image.DecodeConfig`. Decoding compressed images with very large declared dimensions into a full raster can lead to excessive memory allocation and denial of service (decompression bomb).
ServerProtocolIO initialized without max IPC payload bound
ServerProtocolIO is instantiated without specifying a maximum IPC payload byte limit, which allows unconstrained response serialization and potential heap exhaustion or DoS.
A packet sequence gap calculation is used as a loop bound for queue or vector allocation without verifying an upper limit. An attacker can supply a large packet ID to trigger excessive memory allocation and cause a denial of service (DoS).
