QID 580533

QID 580533: String Field Response To Exact Minimum Length Mismatches Schema

In this scenario fields of string type are updated with strings of exact minimum length as defined in the swagger file. If the minimum length is not defined for the string type this test is skipped. All string fields with minimum length defined are update iteratively with strings of exact minimum length and send to the server. The expectation is that server will treat the requests as happy paths since the length of inserted strings matches the minimum.The purpose of the test is to verify that all defined boundaries are properly implemented. Based on testing done replacing string values with the exact minimum defined in swagger file it is determined that the string with valid minimum is accepted. The response code matches the schema definition. The response to some valid values does not match schema definition for field being tested.

Enforcing minimum string length defined in swagger file will help provide clarity to the API users and avoid abuse of the API by hackers. API users might be confused with the response mismatch to valid values.

  • CVSS V3 rated as High - 7.3 severity.
  • CVSS V2 rated as High - 6.4 severity.
  • Solution
    lease update the API endpoint response to match the swagger schema definition or update the schema to match the server response.
    Vendor References

    CVEs related to QID 580533

    Software Advisories
    Advisory ID Software Component Link

    © CVE.report 2026

    Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

    CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

    Free CVE JSON API cve.report/api

    CVE.report and Source URL Uptime Status status.cve.report