Skip to content
OpenAdvisories

Weakness (CWE)

CWE-130: Improper Handling of Length Parameter Inconsistency

Base Incomplete

The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

More detail

If an attacker can manipulate the length parameter associated with an input such that it is inconsistent with the actual length of the input, this can be leveraged to cause the target application to behave in unexpected, and possibly, malicious ways. One of the possible motives for doing so is to pass in arbitrarily large input to the application. Another possible motivation is the modification of application state by including invalid data for subsequent properties of the application. Such weaknesses commonly lead to attacks such as buffer overflows and execution of arbitrary code.

How to prevent it (3 mitigations)

  1. Implementation

    When processing structured incoming data containing a size field followed by raw data, ensure that you identify and resolve any inconsistencies between the size field and the actual size of the data.

  2. Implementation

    Do not let the user control the size of the buffer.

  3. Implementation

    Validate that the length of the user-supplied data is consistent with the buffer size.

Source: MITRE CWE-130

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Low 2.3
    CVE-2026-115794

    Alarm data length not validated against received frame length

    P-Net before 1.0.3 passes the application alarm callback a data length derived from the variable part length field of a received RTA alarm frame without checking it against the length of the received frame. A short frame can make the callback receive a length…

    RT-Labs P-Net
  • Low 3.7
    CVE-2026-116013

    OpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing

    OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can …

    openresty lua-resty-dns lua-nginx-dns lua-nginx-dns Debian Ubuntu
  • Low 3.1
    CVE-2026-101991

    Junos OS and Junos OS Evolved: A BGP-LS peer causes heap data disclosure when traffic-engineering routing is enabled

    An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause heap data disclosure via a malformed UPDATE sent over a sessio…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • Low 2.4
    CVE-2026-15418

    CP210x Memory Leakage

    In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to leak up to 145 bytes of uninitialized kernel pool memory. This vulnerability affects Windows 10 and earlier.

    Silicon Labs silabser.sys driver
  • Low 3.7
    CVE-2025-29931

    A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected product does no…

    Siemens TeleControl Server Basic ICS / OT
  • Low 3.8
    CVE-2020-10065

    Missing Size Checks in Bluetooth HCI over SPI

    Missing Size Checks in Bluetooth HCI over SPI. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Length Parameter Inconsistency (CWE-130). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hg2w-62…

    zephyrproject-rtos Zephyr