Fallos del tipo CWE-158

37 resultados

Neutralização Inadequada de Caractere Nulo (Null Byte)

Ocorre quando a aplicação não trata corretamente o caractere nulo (\0) em strings, permitindo que um invasor interrompa ou contorne validações. Por exemplo, ao processar caminhos de arquivo ou nomes, um null byte pode fazer o parser ignorar tudo que vem depois, contornando filtros de extensão ou whitelist.

Ejemplo

Um validador aceita upload de .txt mas rejeita .php. Um atacante envia 'shell.php\0.txt' — o parser para no null byte e registra apenas 'shell.php', salvando um script malicioso que passa pela validação.

Cómo mitigar

Validar e rejeitar strings contendo null bytes antes de qualquer processamento crítico (arquivo, SQL, comandos do SO); usar APIs seguras que lidam automaticamente com este caractere; implementar whitelist rigorosa baseada em extensão verdadeira, não em substring.

CVE-2024-0408MEDIUMXorg-x11-server: selinux unlabeled glx pbufferEPSS 0.3%CVE-2025-55113CRITICALBMC Control-M/Agent unescaped NULL byte in access control list checksEPSS 0.3%CVE-2026-115473MEDIUMMongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)EPSS 0.3%CVE-2026-116566MEDIUMsocket.getaddrinfo() accepts embedded null bytes in host and portEPSS 0.3%CVE-2026-118767MEDIUMBotan: Python binding bcrypt APIs truncate passwords containing embedded NULsEPSS 0.2%CVE-2026-47778MEDIUMEnvoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)EPSS 0.2%CVE-2026-4359LOWHeap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated bufferEPSS 0.2%CVE-2022-31223LOWDell BIOS versions contain an Improper Neutralization of Null Byte vulnerability. A local authenticated administrator user could potentiallyEPSS 0.2%CVE-2026-43861LOWmutt before 2.3.2 does not check for '\0' in url_pct_decode.EPSS 0.2%CVE-2026-43859LOWmutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest.EPSS 0.2%CVE-2026-41256MEDIUMjq: Embedded NUL truncates top-level jq programs loaded with -fEPSS 0.2%CVE-2026-43895MEDIUMjq: Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifactsEPSS 0.2%CVE-2026-84790HIGHOpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject fieldEPSS 0.1%CVE-2026-70603MEDIUMElectron: shell.openPath path validation bypass via embedded null byteEPSS 0.1%CVE-2026-92705HIGHAegisub executes arbitrary code through automatically loaded Automation scriptsEPSS 0.1%CVE-2025-61985LOWssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.EPSS 0.1%CVE-2026-28540MEDIUMOut-of-bounds character read vulnerability in Bluetooth. Impact: Successful exploitation of this vulnerability may affect service confidentiEPSS 0.1%