CWE-130
Improper Handling of Length Parameter Inconsistency
The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
104 vulnerabilities with CWE-130
CVE-2026-62424
MEDIUM
buffer overruns in libfsimage iso9660 handling
CVSS 5.5
CVE-2026-62423
MEDIUM
buffer overruns in libfsimage iso9660 handling
CVSS 5.5
CVE-2026-26081
MEDIUM
HAProxy - Improper Handling of Length Parameter Inconsistency
CVSS 4.8
CVE-2026-54466
CRITICAL
websocket-driver: Message corruption via abuse of protocol length headers
CVE-2026-48487
MEDIUM
python-zeroconf < 0.149.16 - LAN-Local mDNS RDLENGTH Cache Corruption
CVE-2026-60060
MEDIUM
Teraterm Project TTSSH2 < 3.6.1 - Improper Handling of Length Parameter Inconsistency
CVSS 6.3
CVE-2026-47692
MEDIUM
Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream
CVSS 4.8
CVE-2026-6432
MEDIUM
Silicon Labs EmberZNet SDK <= 9.0.2 - Bounds Validation Crash or Memory Leak
CVE-2026-45681
MEDIUM
OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size
CVSS 5.9
CVE-2026-45615
HIGH
mouse07410/asn1c: 1-byte Heap Out-of-Bounds Read in `INTEGER_decode_oer` via Malformed OER Payload
CVSS 8.2
CVE-2026-48685
MEDIUM
FastNetMon Community Edition <= 1.2.9 - Out-of-Bounds Memory Access via BGP Extended Length Flag Parsing
CVSS 6.5
CVE-2026-9054
CRITICAL
9front - Invalid IP Packets Cause a Kernel Panic
CVE-2026-42216
CRITICAL
OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion
CVSS 9.1
CVE-2026-43125
CRITICAL
dlm: validate length in dlm_search_rsb_tree
CVSS 9.8
CVE-2026-5766
MEDIUM
Django ASGI File Upload - Memory Limit Bypass DoS
CVSS 5.3
CVE-2026-33846
HIGH
Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly
CVSS 7.5
CVE-2026-35547
HIGH
Heap overflow in libnv
CVSS 8.1
CVE-2026-3868
HIGH
Moxa EDR-8010 and EDR-G9010 Series - Unauthenticated Denial of Service via HTTPS Management Interface
CVE-2026-41898
MEDIUM
rust-openssl 0.9.24-0.10.77 - Buffer Overflow
CVSS 5.3
CVE-2026-31635
HIGH
rxrpc: fix oversized RESPONSE authenticator length check
CVSS 7.5
CVE-2026-5367
HIGH
Ovn: ovn: information disclosure via crafted dhcpv6 packets
CVSS 8.6
CVE-2026-5265
MEDIUM
Ovn: ovn: heap over-read in icmp error response generation - security issue
CVSS 6.5
CVE-2026-41035
HIGH
rsync 3.0.1-3.4.1 - Use-After-Free via Untrusted Length Value in receive_xattr
CVSS 7.4
CVE-2026-33555
MEDIUM
HAProxy 2.6-3.3.5 - HTTP/3 Request Smuggling via Empty Payload Frame
CVSS 4.0
CVE-2026-40199
MEDIUM
Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass
CVSS 6.5
Details
Vulnerabilities
104