CWE-135: Incorrect Calculation of Multi-Byte String Length
Filter
The product does not correctly calculate the length of strings that can contain wide or multi-byte characters.
What the weakness is: CWE-135 at MITRE. All weaknesses
Ask an AI about CWE-135
Show the prompt
Explain CWE-135: Incorrect Calculation of Multi-Byte String Length and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/135.html and https://cve.bz/cve/cwe/135?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 6.5CVE-2026-34831EPSS 0.2%
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Files#fail sets the Content-Length response header using String#size instead of String#bytesize. When the response body contains multibyte UTF-…
- 7.1CVE-2026-0810EPSS 0.2%
A flaw was found in gix-date. The `gix_date::parse::TimeBuf::as_str` function can generate strings containing invalid non-UTF8 characters. This issue violates the internal safety invariants of the `TimeBuf` component, leading to undefined …