cve.bz

CWE-158: Improper Neutralization of Null Byte or NUL Character

Filter

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.

What the weakness is: CWE-158 at MITRE

Ask an AI about CWE-158

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-158: Improper Neutralization of Null Byte or NUL Character and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/158.html and https://cve.bz/cve/cwe/158?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.7CVE-2026-105475

    Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.

  2. 4.8CVE-2026-118767EPSS 0.2%

    Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containing U+0000 to const char* values without consistently rejecting the embedded NUL, causing bcrypt and check_bcrypt to pro…

  3. 5.3CVE-2026-116566EPSS 0.3%

    socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated.

  4. 7.6CVE-2026-84790EPSS 0.1%

    OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field

  5. 7.8CVE-2026-92705EPSS 0.1%

    Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `ASS` subtitle projects without asking whether the user trusts the scr…

  6. 5.3CVE-2026-105240EPSS 0.8%

    Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net. A NUL character in logged content ended the debug output record at that point, so everything the layout rendered after…

  7. 5.3CVE-2026-105239EPSS 0.8%

    Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net. A NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it,…

  8. 8.1CVE-2026-76354EPSS 0.4%

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could affect system integrity and availability by sending a crafted Representational State Transfer (REST)…

  9. 6.0CVE-2026-70603EPSS 0.1%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath() did not reject paths containing embedded null bytes. Apps that per…

  10. 4.4CVE-2026-47778EPSS 0.2%

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a structural flaw was identified in DefaultCertValidator::verifySubjectAltName where the extracted DNS SAN…

  11. 4.4CVE-2026-43895EPSS 0.2%

    jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates …

  12. 5.5CVE-2026-41256EPSS 0.2%

    jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \x00 and arbitra…

  13. 3.7CVE-2026-43861EPSS 0.2%

    mutt before 2.3.2 does not check for '\0' in url_pct_decode.

  14. 3.7CVE-2026-43859EPSS 0.2%

    mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest.

  15. 6.5CVE-2026-23863EPSS 0.5%

    An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the application as one type of file but run a…

  16. 8.7CVE-2026-33191EPSS 0.4%

    Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to null byte injection in URL path parameters. A remote attacker can inject null bytes (URL-encoded as …

  17. 2.0CVE-2026-4359EPSS 0.2%

    A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.

  18. 3.3CVE-2026-28540EPSS 0.09%

    Out-of-bounds character read vulnerability in Bluetooth. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

  19. 9.8CVE-2025-14388EPSS 0.5%

    The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in `getExtensionForUR…

  20. 8.9CVE-2025-66263EPSS 0.4%

    Unauthenticated Arbitrary File Read via Null Byte Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Null byte injecti…

  21. 3.6CVE-2025-61985EPSS 0.1%

    ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.

  22. 8.7CVE-2025-9648EPSS 0.8%

    A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the s…

  23. 9.5CVE-2025-55113EPSS 0.3%

    If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions; non-default but configurable using …

  24. 10.0CVE-2025-47812KEVExploitEPSS 94%

    In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges…

  25. 7.3CVE-2025-1936EPSS 0.4%

    jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. Th…

  26. 8.1CVE-2024-10921EPSS 0.6%

    An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions…

  27. 3.3CVE-2024-9026EPSS 0.5%

    In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove u…

  28. 5.5CVE-2024-0408EPSS 0.3%

    A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it create…

  29. 9.8CVE-2023-5719EPSS 0.5%

    The Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for users and to download the resulting security configuration to a device. If such a password contains the percent (%) charac…

  30. 2.3CVE-2022-31223EPSS 0.2%

    Dell BIOS versions contain an Improper Neutralization of Null Byte vulnerability. A local authenticated administrator user could potentially exploit this vulnerability by sending unexpected null bytes in order to read memory on the system.

  31. 5.9CVE-2022-20813EPSS 1.1%

    Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a remote attacker to overwrite arbitrary files or conduct null byt…

  32. 6.5CVE-2022-20812EPSS 1.9%

    Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a remote attacker to overwrite arbitrary files or conduct null byt…

  33. 6.5CVE-2020-7928EPSS 1.4%

    A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries. This issue affects MongoDB Server v4.4 versions prior to 4.4.1; MongoDB Server v4.2 versions prior t…

  34. 9.8CVE-2020-14500EPSS 1.7%

    Secomea GateManager all versions prior to 9.2c, An attacker can send a negative value and overwrite arbitrary data.

  35. 6.7CVE-2020-5363EPSS 0.3%

    Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's manageability interface without knowledge of the current BIOS Admin password. This could potentially all…

  36. 8.8CVE-2009-1537KEVEPSS 51%

    Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute ar…