CWE-130: length manipulation
The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
Also known as Improper Handling of Length Parameter Inconsistency, length tampering.
A kind of CWE-240 Improper Handling of Inconsistent Structural Elements.
From the CWE List. © The MITRE Corporation.
Newest
- simsong tcpflow tcpflow through 1.6.1 Out-of-Bounds Read via TCP Demultiplexer Payload Length 6.3 Medium
- mariadb-corporation mariadb-connector-j MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths 5.9 Medium
- mariadb-corporation mariadb-connector-j MariaDB Connector/J: Rogue server can make the client read past the packet through server-declared lengths 5.9 Medium
- mariadb-corporation mariadb-connector-j MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets 5.9 Medium
- rt-labs p-net Alarm data length not validated against received frame length 2.3 Low
-
libhttp-body-perlDebian,perl-HTTP-BodyopenSUSE +1 more HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk 9.1 Critical - the epics community epics base Improper handling of length parameter inconsistency in EPICS Base 8.7 High
- openresty lua-resty-dns OpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing 6.3 Medium
- mongodb c# driver NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire 6.9 Medium
- hms networks pcan windows can device drivers, peak-system device driver setup +1 more HMS Networks PEAK-System PCAN Windows drivers Improper Handling of Length Parameter Inconsistency 6.8 Medium
- dragonflybsd In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput()... 7.1 High
- juniper networks junos os, junos os evolved +1 more Junos OS and Junos OS Evolved: An attacker sending a malformed update causes an rpd crash when BGP EVPN signaling is used 8.7 High
- nasa fprime F´: TlmPacketizer copies oversized telemetry past configured channel slots and emits corrupted packetized telemetry 6.5 Medium
- juniper networks junos os, junos os evolved +1 more Junos OS and Junos OS Evolved: Insufficient validation of VXLAN overlay ping causes information disclosure when EVPN-VXLAN is configured 5.3 Medium
- juniper networks junos os, junos os evolved +1 more Junos OS and Junos OS Evolved: An attacker causes rpd denial of service when EVPN route signaling is used 8.7 High
- juniper networks junos os, junos os evolved +1 more Junos OS and Junos OS Evolved: Malformed MC-LAG ICCP message causes l2ald heap disclosure or crash 7.1 High
- juniper networks junos os, junos os evolved +1 more Junos OS and Junos OS Evolved: A BGP-LS peer causes heap data disclosure when traffic-engineering routing is enabled 5.3 Medium
- curl IMAP APPEND plus CRLF conversion command injection 8.1 High
- ibm maximo ai service Maximo AI Service Denial of Service 7.5 High
- anydesk AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap... 9.8 Critical
- apache software foundation thrift Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D) 8.7 High
- apache software foundation thrift Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a pee… 8.7 High
- apache software foundation thrift Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length 8.7 High
- apache software foundation thrift Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned name 8.7 High
- thales sconnect SConnect: Native Host Unauthenticated Remote Code Execution Vulnerability 9.4 Critical
- eclipse foundation threadx netx duo Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length 8.7 High
- vectordotdev vector Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation. 8.7 High
- apache software foundation tomcat Apache Tomcat: WebSocket message smuggling with per-message-deflate 7.5 High
- abb freelance controller ac700, freelance controller ac800, freelance controller ac900 +1 more +3 more Missing Length Check 9.2 Critical
- arista networks eos Security Advisory 0173 8.9 High
- haproxy An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5.... 7.5 High
- silicon labs silabser.sys driver CP210x Memory Leakage 2.4 Low
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 +12 more +14 more Windows Storage Management Provider Elevation of Privilege Vulnerability 7.8 High
- silicon labs bt mesh sdk Buffer overflow in Bluetooth Mesh SDK when handling extended advertisements 8.9 High
- suse wicked wicked: out-of-bounds read in the DHCPv4 option parser due to payload length taken from the IP total length 5.3 Medium
- wibu-systems-ag codemeter-runtime Missing Sanity Checks for Buffer Lengths 7.5 High
- freebsd ppp(8): missing length validation in mp_SetEnddisc() 7.8 High
- freebsd ppp(8): missing length validation in LcpDecodeConfig() 8.8 High
- neo4j, neo4j community edition, enterprise edition +2 more Unathenticated connection can hold Bolt channel open 5.5 Medium
- freerdp FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure 9.3 Critical
- xen buffer overruns in libfsimage iso9660 handling 5.5 Medium
- xen buffer overruns in libfsimage iso9660 handling 5.5 Medium
- teraterm project ttssh2 Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in TTSSH2... 5.1 Medium
- faye websocket-driver, websocket-driver-node +1 more websocket-driver: Message corruption via abuse of protocol length headers 9.2 Critical
- envoyproxy envoy Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream 4.8 Medium
- silabs.com emberznet Improper bounds validation in EmberZNet SDK 5.3 Medium
- paulsm zeroconf, python-zeroconf +1 more Zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet 5.3 Medium
- mouse07410 asn1c mouse07410/asn1c: 1-byte Heap Out-of-Bounds Read in `INTEGER_decode_oer` via Malformed OER Payload 8.2 High
- pavel-odintsov fastnetmon FastNetMon Community Edition through 1.2.9 has out-of-bounds memory access because it incorrectly... 6.5 Medium
- 9front Invalid IP packets cause a kernel panic 9.2 Critical
- Show olderLoading…