Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote requests reaching mg_http_upload or mg_http_serve_dir with the affected short path shapes could therefore trigger one-byte heap out-of-bounds reads. On bare-metal or RTOS targets without memory protection, the adjacent byte could be exposed or influence whether a path was accepted, and instrumented builds could crash. This issue is fixed in version 7.22.
CVE-2026-116566 is a vulnerability in the Python Software Foundation's CPython implementation where the socket.getaddrinfo() function accepted null bytes in the host and port parameters, leading to silent truncation of these values. This flaw was present in all versions prior to 3.16.0 and has a medium severity rating. The issue has been fixed in CPython version 3.16.0.
Botan, a C++ cryptography library, had a vulnerability in its Python binding from versions 1.11.22 up to but not including 3.13.0. The issue involved improper handling of embedded null (U+0000) characters in Python strings, causing bcrypt and check_bcrypt functions to process only the string prefix before the null byte. This could allow applications to bypass password policies by validating longer passwords but hashing shorter effective values. The vulnerability does not affect scrypt and argon2 functions. The issue is fixed in Botan version 3.13.0.
Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `ASS` subtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a crafted `ASS` file together with a referenced malicious Automation script, and opening the `AS` file executes arbitrary code with the privileges of the Aegisub process. From 3.4.0 to 3.4.2, inconsistent handling of embedded `NUL` characters between extension validation and filesystem operations additionally allows a crafted `ASS/Lua` polyglot to reference and execute itself as a single-file variant. The vulnerability is fixed in Aegisub 3.5.0.
CVE-2026-105240 is a medium severity vulnerability in Apache log4net affecting versions from 1.2.9 up to but not including 3.5.0. It involves improper neutralization of null byte characters in the OutputDebugStringAppender on Windows platforms. When a null byte appears in logged content, it prematurely terminates the debug output record, causing loss of subsequent log data including exception details. This allows an attacker who can influence log messages to hide parts of the log record. The issue is fixed in version 3.5.0.
CVE-2026-105239 is a medium severity vulnerability in Apache log4net affecting versions from 1.2.9 up to but not including 3.5.0. It involves improper neutralization of null byte characters in the EventLogAppender on Windows. A null byte in logged content prematurely ends the Windows Event Log record, causing subsequent data such as exception text and trailing fields to be omitted silently. This allows data that reaches the log message to hide the rest of that log record. The issue is fixed in version 3.5.0.
CVE-2026-70603 is an improper input validation vulnerability in the Electron framework's shell.openPath() method. Prior to fixed versions, this method did not reject file paths containing embedded null bytes, allowing attackers to bypass string-based validation checks and open unintended files. Applications that rely solely on string validation of file paths derived from untrusted input and pass them to shell.openPath() are affected. The issue is resolved in Electron versions 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1.
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a structural flaw was identified in DefaultCertValidator::verifySubjectAltName where the extracted DNS SAN string is cast to a C-style string using .c_str() before being passed to the Utility::dnsNameMatch() algorithm. If the attacker serves a certificate with a dNSName SAN containing an embedded NUL byte, the helper Utility::generalNameAsString captures the complete string including the NUL. However, when .c_str() evaluates it, implicit conversion to absl::string_view inside dnsNameMatch relies on strlen(), prematurely truncating the evaluation context. Envoy evaluates trucated string against the exact required config_san match and returns true, thereby successfully validating the string with the Nul byte for an upstream routing. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.
jq versions 1.8.1 and earlier contain an improper input validation vulnerability related to embedded NUL bytes in import paths. The jq language parser accepts these NUL bytes, but the underlying file path resolution uses C string operations that terminate at the NUL byte, causing a mismatch between the validated import string and the actual file accessed. This discrepancy can lead to unintended file access. The vulnerability has a medium severity with a CVSS score of 4.4. No official patch or remediation has been confirmed at this time.
jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.
CVE-2026-43861 is a vulnerability in mutt versions before 2.3.2 where the software does not properly check for null byte ('\0') characters in the url_pct_decode function. This improper neutralization of null bytes can lead to limited integrity impact but no confidentiality or availability impact is indicated.
CVE-2026-43859 is a low-severity vulnerability in mutt before version 2.3.2 where the software sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest. This improper handling relates to CWE-158, improper neutralization of null byte or NUL character, which could lead to limited integrity impact.
An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the application as one type of file but run as an executable when opened. We have not seen evidence of exploitation in the wild.
CVE-2026-4359 is a low-severity vulnerability in the MongoDB C Driver caused by improper neutralization of null byte characters (CWE-158). An attacker, such as a compromised third-party cloud server or a man-in-the-middle, can send a malformed HTTP response containing null bytes that triggers a crash in applications using this driver. Exploitation requires high privileges and user interaction, and the attack complexity is high. There are no known exploits in the wild, and no patches have been released yet. The vulnerability primarily impacts the availability of applications relying on the MongoDB C Driver by causing crashes, but it does not affect confidentiality or integrity. Organizations using this driver in their infrastructure should monitor for updates from MongoDB Inc and consider network-level protections to mitigate man-in-the-middle risks. Countries with significant MongoDB usage and cloud infrastructure reliance are more likely to be affected. Overall, the threat is limited in scope and impact but should be addressed to maintain service stability.
The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in `getExtensionForURL()` which operates on URL-decoded paths, and `appendNormalized()` which strips everything after a null byte before constructing the filesystem path. This makes it possible for unauthenticated attackers to read arbitrary files from the webroot, including wp-config.php, by appending a double URL-encoded null byte (%2500) followed by an allowed extension (.txt) to the file path.
Unauthenticated Arbitrary File Read via Null Byte Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Null byte injection in download_setting.php allows reading arbitrary files.
The `/var/tdf/download_setting.php` endpoint constructs file paths by concatenating user-controlled `$_GET['filename']` with a forced `.tgz` extension. Running on PHP 5.3.2 (pre-5.3.4), the application is vulnerable to null byte injection (%00), allowing attackers to bypass the extension restriction and traverse paths. By requesting `filename=../../../../etc/passwd%00`, the underlying C functions treat the null byte as a string terminator, ignoring the appended `.tgz` and enabling unauthenticated arbitrary file disclosure of any file readable by the web server user.
If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions; non-default but configurable using the JAVA_AR setting in newer versions), the verification stops at the first NULL byte encountered in the email address referenced in the client certificate. An attacker could bypass configured ACLs by using a specially crafted certificate.