CWE-626 · Injection and Smuggling
Null Byte Interaction Error (Poison Null Byte)
6CVEs
SortMost likely exploited
6 CVEs with CWE-626 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2019-17137This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR AC1200 R6220 Firmware version 1.1.0.86 Smart WiFi Router. Authen…NETGEAR · AC1200 · CVSS 9.4 · 2020-02-10 | 9.4 | 2.7% | 2020-02-10 |
| CVE-2019-11936Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue affects HHVM versions prior to 3.30.12, all versions between…Facebook · HHVM · 2019-12-04 | – | 1.5% | 2019-12-04 |
| CVE-2026-116130HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_requestHTTP-Parser-XS · CVSS 9.1 · 2026-10-30 | 9.1 | 0.6% | 2026-10-30 |
| CVE-2020-10773A stack information leak flaw was found in s390/s390x in the Linux kernel’s memory manager functionality, where it incorrectly writes to the /proc/sys/vm/cmm_timeout file. This fl…Linux · kernel · CVSS 4.4 · 2020-09-10 | 4.4 | 0.4% | 2020-09-10 |
| CVE-2026-62380Netty before 4.2.16.Final SOCKS Proxy Null Byte Injectionnetty · netty · CVSS 6.3 · 2026-08-22 | 6.3 | 0.3% | 2026-08-22 |
| CVE-2026-76816Netty: MQTT Topic Name and Client ID Validation Bypassnetty · netty · CVSS 3.5 · 2026-08-24 | 3.5 | 0.2% | 2026-08-24 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.