CWE-130.

MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets

• Denial of service
• CWE-130

>=3.0.0, <3.3.7 || >=3.4.0, <3.4.5 || >=3.5.0, <3.5.11 · fixed in 3.3.7, 3.4.5, 3.5.11

MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths

• Memory corruption
• CWE-130

>=3.0.0, <3.3.7 || >=3.4.0, <3.4.5 || >=3.5.0, <3.5.10 · fixed in 3.3.7, 3.4.5, 3.5.10

tcpflow through 1.6.1 Out-of-Bounds Read via TCP Demultiplexer Payload Length

• simsong tcpflow
• CWE-130

MariaDB Connector/J: Rogue server can make the client read past the packet through server-declared lengths

• mariadb-corporation mariadb-connector-j
• Memory corruption
• CWE-130

Alarm data length not validated against received frame length

• RT-Labs P-Net
• CWE-130

HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk

• CWE-130

Improper handling of length parameter inconsistency in EPICS Base

• The EPICS Community EPICS Base
• CWE-130

OpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing

• openresty lua-resty-dns
• CWE-130

NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire

• MongoDB C# Driver
• CWE-130

HMS Networks PEAK-System PCAN Windows drivers Improper Handling of Length Parameter Inconsistency

• HMS Networks PEAK-System Device Driver Setup
• HMS Networks PCAN Windows CAN device drivers
• CWE-130

IMAP APPEND plus CRLF conversion command injection

• curl
• CWE-130

In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address le…

• DragonFlyBSD
• CWE-130

Junos OS and Junos OS Evolved: An attacker sending a malformed update causes an rpd crash when BGP EVPN signaling is used

• Juniper Networks Junos OS
• Juniper Networks Junos OS Evolved
• CWE-130

F´: TlmPacketizer copies oversized telemetry past configured channel slots and emits corrupted packetized telemetry

• nasa fprime
• Memory corruption
• CWE-130

Junos OS and Junos OS Evolved: Insufficient validation of VXLAN overlay ping causes information disclosure when EVPN-VXLAN is configured

• Juniper Networks Junos OS
• Juniper Networks Junos OS Evolved
• CWE-130

Junos OS and Junos OS Evolved: An attacker causes rpd denial of service when EVPN route signaling is used

• Juniper Networks Junos OS
• Juniper Networks Junos OS Evolved
• CWE-130

Junos OS and Junos OS Evolved: Malformed MC-LAG ICCP message causes l2ald heap disclosure or crash

• Juniper Networks Junos OS
• Juniper Networks Junos OS Evolved
• CWE-130

Junos OS and Junos OS Evolved: A BGP-LS peer causes heap data disclosure when traffic-engineering routing is enabled

• Juniper Networks Junos OS
• Juniper Networks Junos OS Evolved
• CWE-130

Maximo AI Service Denial of Service

• IBM Maximo AI Service
• CWE-130

AnyDesk: AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code…

• AnyDesk
• CWE-130

Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D)

• Apache Software Foundation Apache Thrift
• Denial of service
• CWE-130

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a pe…

• Apache Software Foundation Apache Thrift
• Denial of service
• CWE-130

Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length

• Apache Software Foundation Apache Thrift
• Denial of service
• CWE-130

Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned name

• Apache Software Foundation Apache Thrift
• Denial of service
• CWE-130

SConnect: Native Host Unauthenticated Remote Code Execution Vulnerability

• Thales SConnect
• Weak cryptography or TLS
• Memory corruption

Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length

• Eclipse Foundation Eclipse ThreadX NetX Duo
• Memory corruption
• CWE-130

Apache Tomcat: WebSocket message smuggling with per-message-deflate

• Apache Software Foundation Apache Tomcat
• CWE-130

Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation.

• vector
• Denial of service
• CWE-130

Missing Length Check

• ABB Freelance Controller DCP
• ABB Freelance Controller AC700
• CWE-130

Security Advisory 0173

• Arista Networks EOS
• CWE-130

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5.

• HAProxy
• CWE-130

CP210x Memory Leakage

• Silicon Labs silabser.sys driver
• CWE-130

Windows Storage Management Provider Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 21H2
• Microsoft Windows 10 Version 22H2
• Memory corruption
• CWE-130

Buffer overflow in Bluetooth Mesh SDK when handling extended advertisements

• Silicon Labs BT Mesh SDK
• CWE-130

wicked: out-of-bounds read in the DHCPv4 option parser due to payload length taken from the IP total length

• SUSE wicked
• Memory corruption
• CWE-130

Missing Sanity Checks for Buffer Lengths

• wibu-systems-ag codemeter-runtime
• CWE-130

ppp(8): missing length validation in mp_SetEnddisc()

• FreeBSD
• Memory corruption
• CWE-130

ppp(8): missing length validation in LcpDecodeConfig()

• FreeBSD
• Memory corruption
• CWE-130

Unathenticated connection can hold Bolt channel open

• neo4j Enterprise Edition
• neo4j Community Edition
• CWE-130

FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure

• FreeRDP
• CWE-130

buffer overruns in libfsimage iso9660 handling

• Xen
• CWE-130

buffer overruns in libfsimage iso9660 handling

• Xen
• CWE-130

HAProxy: HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the…

• HAProxy
• CWE-130

TeraTerm Project TTSSH2: Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in…

• TeraTerm Project TTSSH2
• CWE-130

websocket-driver: Message corruption via abuse of protocol length headers

• CWE-130

<0.7.5 · fixed in 0.7.5

Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream

• envoy
• CWE-130

Improper bounds validation in EmberZNet SDK

• Silicon Labs EmberZNet
• CWE-130

zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet

• CWE-130

<0.149.16 · fixed in 0.149.16

mouse07410/asn1c: 1-byte Heap Out-of-Bounds Read in `INTEGER_decode_oer` via Malformed OER Payload

• mouse07410 asn1c
• Memory corruption
• CWE-20

FastNetMon Community Edition through 1.2.9 has out-of-bounds memory access because it incorrectly parses BGP path attributes with the extended length flag set.

• CWE-130

Invalid IP packets cause a kernel panic

• 9front
• CWE-130

OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size

• Memory corruption
• CWE-130

<0.9.0 · fixed in 0.9.0

OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion

• AcademySoftwareFoundation openexr
• Memory corruption
• CWE-130

dlm: validate length in dlm_search_rsb_tree

• Linux kernel
• Memory corruption
• CWE-130

Django has an Improper Handling of Length Parameter Inconsistency

• CWE-130

>=5.2, <5.2.14 || >=6.0, <6.0.5 · fixed in 5.2.14, 6.0.5

Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-130

Heap overflow in libnv

• FreeBSD
• Memory corruption
• CWE-130

An improper handling of the length parameter inconsistency vulnerability has been identified in Moxa’s Secure Router.

• Moxa EDR-8010 Series
• Moxa EDR-G9010 Series
• CWE-130

rxrpc: fix oversized RESPONSE authenticator length check

• Linux kernel
• CWE-130

Ovn: ovn: heap over-read in icmp error response generation

• Fast Datapath for Red Hat Enterprise Linux 10
• Fast Datapath for Red Hat Enterprise Linux 8
• CWE-130