cve.bz

CWE-626: Null Byte Interaction Error (Poison Null Byte)

Filter

The product does not properly handle null bytes or NUL characters when passing data between different representations or components.

What the weakness is: CWE-626 at MITRE. All weaknesses

Ask an AI about CWE-626

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-626: Null Byte Interaction Error (Poison Null Byte) and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/626.html and https://cve.bz/cve/cwe/626?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.1CVE-2026-116130EPSS 0.6%

    HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded …

  2. 3.5CVE-2026-76816EPSS 0.2%

    Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allo…

  3. 6.3CVE-2026-62380EPSS 0.3%

    Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEnco…

  4. 9.1CVE-2026-42579EPSS 1.0%

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirecti…

  5. 9.8CVE-2026-42010EPSS 1.1%

    A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specia…

  6. 3.7CVE-2026-42040EPSS 0.2%

    Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-enc…

  7. 4.4CVE-2020-10773EPSS 0.4%

    A stack information leak flaw was found in s390/s390x in the Linux kernel’s memory manager functionality, where it incorrectly writes to the /proc/sys/vm/cmm_timeout file. This flaw allows a local user to see the kernel data.

  8. 9.4CVE-2019-17137EPSS 2.7%

    This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR AC1200 R6220 Firmware version 1.1.0.86 Smart WiFi Router. Authentication is not required to exploit this vulnerability. The …

  9. 9.8CVE-2019-11936EPSS 1.5%

    Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as …