Skip to content
OpenAdvisories

Weakness (CWE)

CWE-228: Improper Handling of Syntactically Invalid Structure

Class Incomplete

The product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.

Source: MITRE CWE-228

All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-107299

    msgpack5: Reserved byte can cause unbounded stream buffering

    msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered whil…

    mcollina msgpack5 msgpack5 npm
  • Medium 6.5
    CVE-2026-50103

    Improper Handling of Syntactically Invalid Structure in MZ Automation libIEC61850

    A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value.

    MZ Automation libIEC61850
  • Medium 6.5
    CVE-2025-59174

    Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability where an attacker sending a large …

    Ericsson Packet Core Controller
  • Medium 5.3
    CVE-2024-53828

    Ericsson Packet Core Controller (PCC) - Improper Handling of Syntactically Invalid Structure Vulnerability

    Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a vulnerability where an attacker sending a large volume of specially crafted messages may cause service degradation.

    Ericsson Packet Core Controller (PCC)
  • Medium 5.5
    CVE-2024-55594

    An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and …

    Fortinet FortiWeb Network devices
  • Medium 5.5
    CVE-2023-42784

    An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7…

    Fortinet FortiWeb Network devices
  • Medium 6.4
    CVE-2024-6382

    Adversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands.

    Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8…

    MongoDB MongoDB Rust Driver mongodb crates.io
  • Medium 6.5
    CVE-2024-22809

    Incorrect access control in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to access the G cod…

  • Medium 5.3
    CVE-2024-22815

    An issue in the communication protocol of Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to ca…

  • Medium 6.6
    CVE-2021-38443

    Eclipse CycloneDDS Improper Handling of Syntactically Invalid Structure

    Eclipse CycloneDDS versions prior to 0.8.0 improperly handle invalid structures, which may allow an attacker to write arbitrary values in the XML parser.

    eclipse CycloneDDS cyclonedds cyclonedds Debian Ubuntu
  • Medium 5.3
    CVE-2021-36199

    VideoEdge

    Running a vulnerability scanner against VideoEdge NVRs can cause some functionality to stop.

    Johnson Controls VideoEdge
  • Medium 6.5
    CVE-2018-5381 EPSS 30%

    The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in…

    quagga bgpd quagga Ubuntu