The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

What CVEs are caused by CWE-1284?

232 recorded CVEs are attributed to CWE-1284, including CVE-2026-49777, CVE-2024-8887, CVE-2026-25345.

How do you prevent CWE-1284?

Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

How is CWE-1284 detected?

Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

What are the consequences of CWE-1284?

Exploiting CWE-1284 can lead to: Varies by Context, DoS: Resource Consumption (CPU), Modify Memory, Read Memory.

Is CWE-1284 actively exploited?

232 recorded CVEs are caused by CWE-1284; none are currently in CISA's KEV catalog of actively exploited flaws.

CWE-1284: Improper Validation of Specified Quantity in Input

RadicalNotion.AI

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

This example demonstrates a shopping interaction in which the user is free to specify the quantity of items to be purchased and a total is calculated.

The user has no control over the price variable, however the code does not prevent a negative value from being specified for quantity. If an attacker were to provide a negative value, then the user would have their account credited instead of debited.

This example asks the user for a height and width of an m X n game board with a maximum dimension of 100 squares.

Vulnerable example

/* board dimensions */
...

While this code checks to make sure the user cannot specify large, positive integers and consume too much memory, it does not check for negative values supplied by the user. As a result, an attacker can perform a resource consumption (CWE-400) attack against this program by specifying two, large negative values that will not overflow, resulting in a very large memory allocation (CWE-789) and possibly a system crash. Alternatively, an attacker can provide very large negative values which will cause an integer overflow (CWE-190) and unexpected behavior will follow depending on how the values are treated in the remainder of the program.

The following code is a workflow job written using YAML. The code attempts to download pull request artifacts, unzip from the artifact called pr.zip and extract the value of the file NR into a variable "pr_number" that will be used later in another job. It attempts to create a github workflow environment variable, writing to $GITHUB_ENV. The environment variable value is retrieved from an external resource.

Vulnerable example

other

deploy:

The following PHP code could be from a shopping cart application. It allows users to apply a discount to an item.

Vulnerable example

php

$discount = $_POST['discount'];

Safe example

php

// only these discounts are valid
$original_price = 100.00;

CWE-1284: Improper Validation of Specified Quantity in Input

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

How to prevent it

How to detect it

Automated Static Analysis

Code examples

Illustrative examples

Frequently asked questions

References

Stay ahead of CWE-1284

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

How to prevent it

How to detect it

Automated Static Analysis

Code examples

Illustrative examples

Related weaknesses

Parent

Child

Can precede

Frequently asked questions

References

Stay ahead of CWE-1284