Improper Handling of Inconsistent Structural Elements

Opis

The product does not handle or incorrectly handles when two or more structural elements should be consistent, but are not.

Skutki

• Integrity, Other

  Varies by Context; Unexpected State

Przykłady podatności

• CVE-2014-0160 Chain: "Heartbleed" bug receives an inconsistent length parameter (CWE-130) enabling an out-of-bounds read (CWE-126), returning memory that could include private cryptographic keys and other sensitive data.
• CVE-2009-2299 Web application firewall consumes excessive memory when an HTTP request contains a large Content-Length value but no POST data.

Słabość nadrzędna

• CWE-237 Improper Handling of Structural Elements
• CWE-707 Improper Neutralization

Słabości podrzędne

• CWE-130 Improper Handling of Length Parameter Inconsistency

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific, Not Technology-Specific