Improper Neutralization of Null Byte or NUL Character
CWE-158
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.
We track 12 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.8. 2 have been exploited in real attacks.
How this weakness is prevented
- Developers should anticipate that null characters or null bytes will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
- Implementation: Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
Latest Improper Neutralization of Null Byte or NUL Character vulnerabilities
- 7.8 High severity
Aegisub: Improper Neutralization of Null Byte or NUL Character
Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `ASS` subtitle projects without asking whether the user trusts the scripts or their authors
- 8.1 High severity
Splunk Enterprise: Improper Neutralization of Null Byte or NUL Character
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could affect system integrity and availability by sending a crafted Representational State Transfer (REST) API request that del
- 8.6 High severity
free5gc: Improper Neutralization of Null Byte or NUL Character
Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to null byte injection in URL path parameters. A remote attacker can inject null bytes (URL-encoded as %00) into the supi pa
- 9.8 Critical severity
PhastPress: Improper Neutralization of Null Byte or NUL Character
The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in `getExtensionForURL()` which operates o
- 7.5 High severity
Mozart FM Transmitter: Improper Neutralization of Null Byte or NUL Character
Unauthenticated Arbitrary File Read via Null Byte Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Null byte injection in download_settin
- 8.7 High severity
CivetWeb: Improper Neutralization of Null Byte or NUL Character
A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infin
- 10.0 Critical severity
Control-M/Agent: Improper Neutralization of Null Byte or NUL Character
If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions; non-default but configurable using the JAVA_AR setting i
- 10.0 Critical severity
Wing FTP Server Improper Neutralization of Null Byte or NUL Character Exploited
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (
- 7.3 High severity
Firefox: Improper Neutralization of Null Byte or NUL Character
jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. This could have been us
- 8.1 High severity
MongoDB Server: Improper Neutralization of Null Byte or NUL Character
An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , Mo
- 9.8 Critical severity
Crimson: Improper Neutralization of Null Byte or NUL Character
The Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for users and to download the resulting security configuration to a device. If such a password contains the percent (%) character, invalid values w
- 9.3 High severity
Microsoft DirectX NULL Byte Overwrite Exploited
Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a cr