CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input
Description
The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-1285 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-3qwc-47jf-5rf7 | - | MODERATE |
eth-abi is vulnerable to recursive DoS |
2026-09-01 | |
| GHSA-9r4w-jg96-92mv | CVE-2026-12681 | HIGH |
Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList() |
2026-08-28 | |
| GHSA-2f9f-gq7v-9h6m | CVE-2026-43868 | MODERATE | - |
Apache Thrift has a Memory Allocation with Excessive Size Value Vulnerability |
2026-07-21 |
| GHSA-4hgp-59h5-gvrj | CVE-2026-53530 | HIGH | - |
ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice) |
2026-07-07 |
| GHSA-w5hq-g745-h8pq | CVE-2026-41907 | MODERATE |
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided |
2026-05-21 | |
| GHSA-28jg-cgg7-j4wc | CVE-2026-33557 | CRITICAL |
Apache Kafka does not validate JWT tokens in its OAUTHBEARER authentication implementation |
2026-04-24 | |
| GHSA-xrf2-5r3p-5wgj | - | HIGH | - |
libcrux: Panic in Signature Hint Decoding During Verification |
2026-03-26 |
| GHSA-c85w-x26q-ch87 | - | HIGH | - |
Formwork improperly validates input of User role preventing site and panel availability |
2026-02-18 |
| GHSA-2557-x9mg-76w8 | - | MODERATE |
ASA-2024-002: Default `PrepareProposalHandler` may produce invalid proposals when used with default `SenderNonceMempool` |
2024-05-23 |