CWE-130 · Memory Corruption
Improper Handling of Length Parameter Inconsistency
128CVEs
SortMost likely exploited
128 CVEs with CWE-130 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-14847In CISA KEVExploitedMongoDB Server - Information Disclosure (MongoBleed)MongoDB Inc. · MongoDB Server · CVSS 7.5 · 2025-12-19 | 7.5 | 83% | 2025-12-19 |
| CVE-2024-39614An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very…Djangoproject · Django · CVSS 7.5 · 2024-07-10 | 7.5 | 29% | 2024-07-10 |
| CVE-2021-36090Apache Commons Compress 1.0 to 1.20 denial of service vulnerabilityApache Software Foundation · Apache Commons Compress · 2021-07-13 | – | 13% | 2021-07-13 |
| CVE-2021-35516Apache Commons Compress 1.6 to 1.20 denial of service vulnerabilityApache Software Foundation · Apache Commons Compress · 2021-07-13 | – | 12% | 2021-07-13 |
| CVE-2021-35517Apache Commons Compress 1.1 to 1.20 denial of service vulnerabilityApache Software Foundation · Apache Commons Compress · 2021-07-13 | – | 11% | 2021-07-13 |
| CVE-2019-3862An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attack…The libssh2 Project · libssh2 · CVSS 7.3 · 2019-03-20 | 7.3 | 7.9% | 2019-03-20 |
| CVE-2021-20588Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging Configuration Tool versions 1.112R and prior,…Mitsubishi Electric Corporation · CPU Module Logging Configuration Tool · CVSS 7.5 · 2021-02-19 | 7.5 | 6.9% | 2021-02-19 |
| CVE-2024-20685Azure Private 5G Core Denial of Service VulnerabilityMicrosoft · Azure Private 5G Core · CVSS 5.9 · 2024-04-09 | 5.9 | 5.5% | 2024-04-09 |
| CVE-2020-8927Buffer overflow in Brotli libraryGoogle LLC · Brotli · CVSS 5.3 · 2020-09-15 | 5.3 | 3.3% | 2020-09-15 |
| CVE-2021-20610Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120(EN)CPU, MELSEC iQ-R S…Mitsubishi Electric Corporation · MELSEC iQ-R Series R00CPU · CVSS 7.5 · 2021-12-01 | 7.5 | 3.3% | 2021-12-01 |
| CVE-2021-38445OCI OpenDDS Secure Improper Handling of Length Parameter InconsistencyOCI · OpenDDS · CVSS 7 · 2022-05-05 | 7.0 | 2.7% | 2022-05-05 |
| CVE-2021-36374Apache Ant ZIP, and ZIP based, archive denial of service vulerabilityApache Software Foundation · Apache Ant · 2021-07-14 | – | 2.6% | 2021-07-14 |
| CVE-2021-36373Apache Ant TAR archive denial of service vulnerabilityApache Software Foundation · Apache Ant · 2021-07-14 | – | 2.5% | 2021-07-14 |
| CVE-2021-43666A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's length is 0.Arm · Mbed Tls · CVSS 7.5 · 2022-03-24 | 7.5 | 2.1% | 2022-03-24 |
| CVE-2022-3272Improper Handling of Length Parameter Inconsistency in ikus060/rdiffwebikus060 · ikus060/rdiffweb · CVSS 5.3 · 2022-09-26 | 5.3 | 1.8% | 2022-09-26 |
| CVE-2026-109390AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root wit…AnyDesk · AnyDesk · CVSS 9.8 · 2026-10-12 | 9.8 | 1.6% | 2026-10-12 |
| CVE-2022-24666A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This attack affects all swift-nio-h…Swift Project · SwiftNIO HTTP2 · 2022-02-09 | – | 1.4% | 2022-02-09 |
| CVE-2019-0055Junos OS: SRX Series: An attacker may cause flowd to crash by sending certain valid SIP traffic to a device with SIP ALG enabled.Juniper Networks · Junos OS · CVSS 7.5 · 2019-10-09 | 7.5 | 1.3% | 2019-10-09 |
| CVE-2022-0618A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This vulnerability is caused by a l…Swift Project · SwiftNIO HTTP2 · 2022-03-09 | – | 1.3% | 2022-03-09 |
| CVE-2023-40167Jetty accepts "+" prefixed value in Content-Lengtheclipse · jetty.project · CVSS 5.3 · 2023-09-15 | 5.3 | 1.3% | 2023-09-15 |
| CVE-2026-33846Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassemblyRed Hat · Red Hat Enterprise Linux 10 · CVSS 7.5 · 2026-05-04 | 7.5 | 1.3% | 2026-05-04 |
| CVE-2024-38011Secure Boot Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 8 · 2024-07-09 | 8.0 | 1.3% | 2024-07-09 |
| CVE-2024-41990An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via v…Djangoproject · Django · CVSS 7.5 · 2024-08-07 | 7.5 | 1.3% | 2024-08-07 |
| CVE-2022-0677Improper Handling of Length Parameter Inconsistency vulnerability in Bitdefender Update Server (VA-10144)Bitdefender · Update Server · CVSS 7.5 · 2022-04-07 | 7.5 | 1.2% | 2022-04-07 |
| CVE-2024-38875An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a ver…Djangoproject · Django · CVSS 7.5 · 2024-07-10 | 7.5 | 1.2% | 2024-07-10 |
| CVE-2018-5453An Improper Handling of Length Parameter Inconsistency issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. An attacker may be able to edit…Moxa · Moxa OnCell G3100-HSPA Series · 2018-03-05 | – | 1.2% | 2018-03-05 |
| CVE-2026-31635rxrpc: fix oversized RESPONSE authenticator length checkLinux · Linux · CVSS 7.5 · 2026-04-24 | 7.5 | 1.1% | 2026-04-24 |
| CVE-2022-1543Improper handling of Length parameter in erudika/scoolderudika · erudika/scoold · CVSS 9.3 · 2022-04-29 | 9.3 | 1.1% | 2022-04-29 |
| CVE-2025-8531Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series Q03UDVCPU, Q04UDVCPU, Q06UDVCPU, Q13UDVCPU, Q26UDVCPU, Q04UDPV…Mitsubishi Electric Corporation · MELSEC-Q Series Q03UDVCPU · CVSS 6.8 · 2025-09-19 | 6.8 | 1.1% | 2025-09-19 |
| CVE-2022-20686Multiple vulnerabilities in the Link Layer Discovery Protocol (LLDP) functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote…Cisco · Cisco Analog Telephone Adaptor (ATA) Software · CVSS 5.3 · 2022-12-07 | 5.3 | 1.0% | 2022-12-07 |
| CVE-2022-20870Cisco IOS XE Software for Catalyst Switches MPLS Denial of Service VulnerabilityCisco · Cisco IOS XE Software · CVSS 8.6 · 2022-10-10 | 8.6 | 1.0% | 2022-10-10 |
| CVE-2024-38010Secure Boot Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 8 · 2024-07-09 | 8.0 | 1.0% | 2024-07-09 |
| CVE-2024-37989Secure Boot Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 8 · 2024-07-09 | 8.0 | 1.0% | 2024-07-09 |
| CVE-2024-37988Secure Boot Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 8 · 2024-07-09 | 8.0 | 1.0% | 2024-07-09 |
| CVE-2021-3454Truncated L2CAP K-frame causes assertion failurezephyrproject-rtos · zephyr · CVSS 4.3 · 2021-10-19 | 4.3 | 1.0% | 2021-10-19 |
| CVE-2024-41991An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potenti…Djangoproject · Django · CVSS 7.5 · 2024-08-07 | 7.5 | 1.0% | 2024-08-07 |
| CVE-2024-24976A denial of service vulnerability exists in the OAS Engine File Data Source Configuration functionality of Open Automation Software OAS Platform V19.00.0057. A specially crafted s…Open Automation Software · OAS Platform · CVSS 4.9 · 2024-04-03 | 4.9 | 0.9% | 2024-04-03 |
| CVE-2022-3290Improper Handling of Length Parameter Inconsistency in ikus060/rdiffwebikus060 · ikus060/rdiffweb · CVSS 5.7 · 2022-09-26 | 5.7 | 0.9% | 2022-09-26 |
| CVE-2022-2714Improper Handling of Length Parameter Inconsistency in francoisjacquet/rosariosisfrancoisjacquet · francoisjacquet/rosariosis · CVSS 8.1 · 2022-09-06 | 8.1 | 0.9% | 2022-09-06 |
| CVE-2026-5367Ovn: ovn: information disclosure via crafted dhcpv6 packetsRed Hat · Fast Datapath for Red Hat Enterprise Linux 10 · CVSS 8.6 · 2026-04-24 | 8.6 | 0.9% | 2026-04-24 |
| CVE-2024-20416A vulnerability in the upload module of Cisco RV340 and RV345 Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected d…Cisco · Cisco Small Business RV Series Router Firmware · CVSS 6.5 · 2024-07-17 | 6.5 | 0.9% | 2024-07-17 |
| CVE-2026-87864IMAP APPEND plus CRLF conversion command injectioncurl · curl · CVSS 8.1 · 2026-10-20 | 8.1 | 0.8% | 2026-10-20 |
| CVE-2022-20690Multiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, adjacent attacker…Cisco · Cisco Analog Telephone Adaptor (ATA) Software · CVSS 5.3 · 2022-12-07 | 5.3 | 0.8% | 2022-12-07 |
| CVE-2026-90678An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and conf…HAProxy · HAProxy · CVSS 7.5 · 2026-09-13 | 7.5 | 0.8% | 2026-09-13 |
| CVE-2024-29064Windows Hyper-V Denial of Service VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 6.2 · 2024-04-09 | 6.2 | 0.7% | 2024-04-09 |
| CVE-2023-5393Server receiving a malformed message that causes a disconnect to a hostname may causing a stack overflow resulting in possible remote code execution. Honeywell recommends updating…Honeywell · Experion Server · CVSS 7.4 · 2024-04-11 | 7.4 | 0.7% | 2024-04-11 |
| CVE-2023-33192Improper handling of NTS cookie length that could crash the ntpd-rs serverpendulum-project · ntpd-rs · CVSS 7.5 · 2023-05-27 | 7.5 | 0.7% | 2023-05-27 |
| CVE-2022-20689Multiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, adjacent attacker…Cisco · Cisco Analog Telephone Adaptor (ATA) Software · CVSS 5.3 · 2022-12-07 | 5.3 | 0.7% | 2022-12-07 |
| CVE-2021-27862L2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with an invalid length during Ethernet to Wifi frame translationIEEE · 802.2 · CVSS 4.7 · 2022-09-27 | 4.7 | 0.7% | 2022-09-27 |
| CVE-2025-29784NamelessMC Has Lack of Length Validation for s Parameter in GET RequestsNamelessMC · Nameless · CVSS 7.5 · 2025-04-18 | 7.5 | 0.7% | 2025-04-18 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.