Threats Tagged 'cwe-158'

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a structural flaw was identified in DefaultCertValidator::verifySubjectAltName where the extracted DNS SAN string is cast to a C-style string using .c_str() before being passed to the Utility::dnsNameMatch() algorithm. If the attacker serves a certificate with a dNSName SAN containing an embedded NUL byte, the helper Utility::generalNameAsString captures the complete string including the NUL. However, when .c_str() evaluates it, implicit conversion to absl::string_view inside dnsNameMatch relies on strlen(), prematurely truncating the evaluation context. Envoy evaluates trucated string against the exact required config_san match and returns true, thereby successfully validating the string with the Nul byte for an upstream routing. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

jq versions 1.8.1 and earlier contain an improper input validation vulnerability related to embedded NUL bytes in import paths. The jq language parser accepts these NUL bytes, but the underlying file path resolution uses C string operations that terminate at the NUL byte, causing a mismatch between the validated import string and the actual file accessed. This discrepancy can lead to unintended file access. The vulnerability has a medium severity with a CVSS score of 4.4. No official patch or remediation has been confirmed at this time.

jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.

An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the application as one type of file but run as an executable when opened. We have not seen evidence of exploitation in the wild.

CVE-2026-4359 is a low-severity vulnerability in the MongoDB C Driver caused by improper neutralization of null byte characters (CWE-158). An attacker, such as a compromised third-party cloud server or a man-in-the-middle, can send a malformed HTTP response containing null bytes that triggers a crash in applications using this driver. Exploitation requires high privileges and user interaction, and the attack complexity is high. There are no known exploits in the wild, and no patches have been released yet. The vulnerability primarily impacts the availability of applications relying on the MongoDB C Driver by causing crashes, but it does not affect confidentiality or integrity. Organizations using this driver in their infrastructure should monitor for updates from MongoDB Inc and consider network-level protections to mitigate man-in-the-middle risks. Countries with significant MongoDB usage and cloud infrastructure reliance are more likely to be affected. Overall, the threat is limited in scope and impact but should be addressed to maintain service stability.

LowVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-4359#cwe-158

Out-of-bounds character read vulnerability in Bluetooth. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

MediumVulnerabilityChinaIndiaRussia+7#cve#cve-2026-28540#cwe-158

The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in `getExtensionForURL()` which operates on URL-decoded paths, and `appendNormalized()` which strips everything after a null byte before constructing the filesystem path. This makes it possible for unauthenticated attackers to read arbitrary files from the webroot, including wp-config.php, by appending a double URL-encoded null byte (%2500) followed by an allowed extension (.txt) to the file path.

Unauthenticated Arbitrary File Read via Null Byte Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Null byte injection in download_setting.php allows reading arbitrary files. The `/var/tdf/download_setting.php` endpoint constructs file paths by concatenating user-controlled `$_GET['filename']` with a forced `.tgz` extension. Running on PHP 5.3.2 (pre-5.3.4), the application is vulnerable to null byte injection (%00), allowing attackers to bypass the extension restriction and traverse paths. By requesting `filename=../../../../etc/passwd%00`, the underlying C functions treat the null byte as a string terminator, ignoring the appended `.tgz` and enabling unauthenticated arbitrary file disclosure of any file readable by the web server user.

HighVulnerabilityItalyGermanyFrance+7#cve#cve-2025-66263#cwe-158

ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.

If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions; non-default but configurable using the JAVA_AR setting in newer versions), the verification stops at the first NULL byte encountered in the email address referenced in the client certificate. An attacker could bypass configured ACLs by using a specially crafted certificate.

CriticalVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2025-55113#cwe-158