Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
A buffer growth routine exponentially increases buffer capacity without checking against a maximum decoded size limit. This may allow decompression bombs or oversized stream inputs to exhaust system memory and cause a denial of service.
`parse_qs_bytes` is invoked without specifying `max_num_fields`. Parsing URL-encoded bodies or query strings without a field count limit allows an attacker to send payloads with millions of parameters, blocking Tornado's event loop and causing a Denial of Service (CVE-2026-82397). Pass `max_num_fields` to bound parameter parsing.
Argon2 KDF cost parameters (such as memory_cost) are passed directly to key derivation without prior upper-bound validation. If derived from untrusted files or configuration, an excessively high memory_cost can lead to an out-of-memory denial of service.
Envelope decryption recovery slots from untrusted metadata are processed without validating against a maximum slot count limit. An attacker can supply a crafted file with numerous recovery slots to cause pre-authentication CPU and memory exhaustion (DoS).
WebSocket framing or decompression logic lacks upper bound checks on message/buffer sizes.
STIX 2 content is read and parsed without prior input size validation, potentially leading to memory exhaustion and denial of service.
Cloning the entire active namespace or scope map from the top of a stack on each element push creates quadratic (O(N^2)) memory and CPU overhead during nested parsing, potentially leading to denial of service (OutOfMemoryError). Use an undo/delta log or persistent data structure instead of cloning the entire map per scope.
Fee sponsorship validates transaction economics per individual transaction without reserving in-flight aggregate budget, allowing concurrent requests to drain the fee-payer wallet.
WebSocket frame aggregator instantiated without specifying a maximum aggregate message size limit. Unbounded aggregation of continuation frames can lead to OutOfMemoryError and denial of service.
Quota or bandwidth usage counters are decremented before checking if a session is mobile or suspended. This prematurely releases quota counters while session resources remain active, allowing quota enforcement bypass.
Apache HTTP Server configuration does not define RequestReadTimeout directives, leaving endpoints susceptible to slowloris and resource exhaustion denial of service.
In-memory cache uses an unbounded plain JavaScript object with dynamic key assignments and no size limit or eviction policy. If populated with dynamic inputs, this can cause unbounded memory growth and process crash (DoS).
HTTP request body is copied directly to a destination writer without enforcing a maximum length bound. This can allow oversized uploads to exhaust disk space or memory. Use 'io.LimitReader', 'io.CopyN', or 'http.MaxBytesReader' to enforce upload limits.
Unconstrained range expansion detected in dictionary comprehension. When range parameters are parsed from external data, constructing ranges without validating length or maximum entry limits can result in denial of service through high memory and CPU consumption.
Direct call to `MapConstructor.construct` during protocol decoding bypasses `ValueHandler` nested object tracking and parser safety limits. Use `ValueHandler.parseMapWithConstructor` instead.
Converting dynamic or user-controlled input into atoms using 'String.to_atom' can lead to atom table exhaustion and crash the Erlang VM (BEAM). Use 'String.to_existing_atom' with error handling instead.
The application decodes an image without first validating its dimensions using `image.DecodeConfig`. Decoding compressed images with very large declared dimensions into a full raster can lead to excessive memory allocation and denial of service (decompression bomb).
ServerProtocolIO initialized without max IPC payload bound
ServerProtocolIO is instantiated without specifying a maximum IPC payload byte limit, which allows unconstrained response serialization and potential heap exhaustion or DoS.
A packet sequence gap calculation is used as a loop bound for queue or vector allocation without verifying an upper limit. An attacker can supply a large packet ID to trigger excessive memory allocation and cause a denial of service (DoS).
Fragmented WebSocket frames or network data are accumulated into an evbuffer without checking the cumulative message length against a maximum size limit. An attacker can send endless fragments to exhaust memory (DoS).
QUIC outgoing packets are committed to FIFD/ACKM history without verifying whether they are ACK-only packets. ACK-only packets are non-ack-eliciting and will never be acknowledged by the peer, causing unbounded memory growth (CVE-2026-63075).
Incoming CMP extra certificates are added to the untrusted certificate stack but are only purged when caching is explicitly disabled. If validation fails, these certificates remain cached in the context indefinitely, leading to unbounded memory growth and denial of service. Ensure extra certificates are also removed when validation fails.
DocumentBuilderFactory is initialized without configuring maximum XML element nesting depth via `jdk.xml.maxElementDepth`. Parsing deeply nested XML structures without depth bounds can lead to unbounded recursion, StackOverflowError, and Denial of Service (DoS).
