Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
String or list multiplication with dynamically calculated values may lead to uncontrolled memory consumption and Denial of Service (DoS). Ensure the sequence multiplier is explicitly bounded before execution.
An integer count decoded from untrusted external data is passed to Vec::with_capacity without bounding it against the remaining readable packet/buffer bytes. A crafted large count (e.g. u32::MAX ~4 billion) can trigger a multi-gigabyte heap allocation, crashing the process via OOM before any credential is verified (pre-auth DoS). Clamp the decoded count to t
An array is allocated using a length directly read from a stream or payload without bounded validation. An attacker can supply an artificially large variable length, triggering an excessive memory allocation that exhausts JVM memory (OutOfMemoryError) and leads to Denial of Service (DoS). Always check that the requested size does not exceed the remaining ava
Eagerly allocating a buffer based on an unverified length before asynchronously reading chunks can lead to Denial of Service (DoS) via memory exhaustion. Defend against this by deferring allocation until all chunks are successfully read or validating the requested length against known HTTP Content-Length bounds.
An array is allocated using a size directly from a method parameter without an explicit upper bound check wrapping the allocation. If the size is controlled by an attacker during parsing or deserialization, this can lead to unbounded memory allocation, OutOfMemoryError, and Denial of Service (DoS). Validate the size against a reasonable threshold before allo
