Advisories · Weakness
CWE-228.
Every Advisory and CVE whose sources give the weakness CWE-228, newest first.
- CVSS 5.9 Medium
msgpack5: Reserved byte can cause unbounded stream buffering
- CWE-228
<6.1.0 · fixed in 6.1.0
GHSA-26wq-p25c-j6fv · CVE-2026-107299 - CVSS 7.4 High
Langflow: Weak Fernet Key via random.seed()
- Weak cryptography or TLS
- CWE-228
<1.10.1 · fixed in 1.10.1
GHSA-jxw3-mjmx-3pqm · CVE-2026-9205 - CVSS 10.0 CriticalCritical · CVSS 9+
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret.
- mistralai mistral-vibe
- CWE-228
- CVSS 7.1 High
Improper Handling of Syntactically Invalid Structure in MZ Automation libIEC61850
- MZ Automation libIEC61850
- CWE-228
- CVSS 7.1 High
Ericsson Packet Core Controller: Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability…
- Ericsson Packet Core Controller
- CWE-228
- CVSS 7.1 High
Ericsson Packet Core Gateway (PCG) - Improper Handling of Syntactically Invalid Structure Vulnerability
- Ericsson Packet Core Gateway (PCG)
- CWE-228
- CVSS 7.1 High
DoS in Sparx Pro Cloud Server
- Sparx Systems Pro Cloud Server
- CWE-228
- CVSS 7.5 High
Firebird: DoS via `op_response` packet from client
- firebird
- CWE-228
- CVSS 5.3 Medium
Ericsson Packet Core Controller (PCC) - Improper Handling of Syntactically Invalid Structure Vulnerability
- Ericsson Packet Core Controller (PCC)
- CWE-228
- CVSS 7.7 High
Cisco IOS: A vulnerability in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE…
- Cisco IOS
- Cisco IOS XE Software
- CWE-228
- CVSS 2.9 Low
IBM Terracotta denial of service
- IBM Terracotta
- CWE-228
- CVSS 4.0, no score published
CometBFT's invalid BitArray handling can lead to network halt
- CWE-228
<0.37.16 || >=0.38.0-alpha.1, <0.38.19 · fixed in 0.37.16, 0.38.19
GHSA-hrhf-2vcr-ghch - CVSS 2.9 Low
libsql-sqlite3-parser crash due to invalid UTF-8 input
- CWE-228
<=0.13.0 · no fixed version yet
GHSA-8m95-fffc-h4c5 · CVE-2025-47736 - CVSS 5.5 Medium
Fortinet FortiWeb: An improper handling of syntactically invalid structure in Fortinet FortiWeb at least…
- Fortinet FortiWeb
- CWE-228
- CVSS 5.5 Medium
Fortinet FortiWeb: An improper handling of syntactically invalid structure in Fortinet FortiWeb at least…
- Fortinet FortiWeb
- CWE-228
- CVSS 7.5 High
Swift ASN.1 can be caused to crash when parsing certain BER/DER constructions.
- Swift Project Swift ASN1
- CWE-228
- CVSS 6.4 Medium
MongoDB Rust driver may issue unintended commands
- CWE-228
>=2.0.0, <2.8.2 · fixed in 2.8.2
GHSA-32jf-h775-g29h · CVE-2024-6382 - CVSS 5.3 Medium
An issue in the communication protocol of Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) via crafted commands.
- CWE-228
- CVSS 6.5 Medium
Incorrect access control in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to access the G code's shared folder and view sensitive information.
- CWE-228
- CVSS 7.5 High
Junos OS Evolved: Specific TCP traffic causes OFP core and restart of RE
- Juniper Networks Junos OS Evolved
- CWE-228
- CVSS 7.5 High
BER/CER/DER decoder panics on invalid input
- CWE-228
- CWE-232
<0.7.3 · fixed in 0.7.3
GHSA-6jmw-6mxw-w4jc · CVE-2023-39914 - CVSS 6.6 Medium
Eclipse CycloneDDS Improper Handling of Syntactically Invalid Structure
- Eclipse CycloneDDS
- CWE-228
- CVSS 5.3 Medium
VideoEdge
- Johnson Controls VideoEdge
- CWE-228
- CVSS 9.3 CriticalCritical · CVSS 9+
Critical security issues in XML encoding in github.com/dexidp/dex
- Weak cryptography or TLS
- CWE-228
<2.27.0 · fixed in 2.27.0
GHSA-m9hp-7r99-94h5 · CVE-2020-26290 - CVSS 6.5 Medium
Quagga bgpd: The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of…
- Quagga bgpd
- CWE-228