cve.bz

CWE-839: Numeric Range Comparison Without Minimum Check

Filter

The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.

What the weakness is: CWE-839 at MITRE. All weaknesses

Ask an AI about CWE-839

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-839: Numeric Range Comparison Without Minimum Check and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/839.html and https://cve.bz/cve/cwe/839?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.1CVE-2026-118384EPSS 0.3%

    GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.

  2. 7.5CVE-2026-57186EPSS 0.6%

    Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the `chan_ooh323` `Q.931 party-number parser` lacks the `CVE-2022-37325` …

  3. 9.8CVE-2026-53176EPSS 0.8%

    In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length a…

  4. 5.3CVE-2026-56968EPSS 0.4%

    GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.

  5. 5.3CVE-2026-48840EPSS 0.3%

    Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client.

  6. 7.5CVE-2023-0425EPSS 0.5%

    ABB is aware of vulnerabilities in the product versions listed below. An update is available that resolves the reported vulnerabilities in the product versions under maintenance. An attacker who successfully exploited one or more of these …

  7. 7.5CVE-2023-22854EPSS 0.6%

    The ccmweb component of Mitel MiContact Center Business server 9.2.2.0 through 9.4.1.0 could allow an unauthenticated attacker to download arbitrary files, due to insufficient restriction of URL parameters. A successful exploit could allow…

  8. 7.5CVE-2019-20925EPSS 1.7%

    An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.…