CWE-135: Incorrect Calculation of Multi-Byte String Length

Base

The product does not correctly calculate the length of strings that can contain wide or multi-byte characters.

Consequences

Integrity, Confidentiality, Availability: Execute Unauthorized Code or Commands
Availability, Confidentiality: Read Memory, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)
Confidentiality: Read Memory

How to prevent it

Implementation: Always verify the length of the string unit character.
Implementation: Use length computing functions (e.g. strlen, wcslen, etc.) appropriately with their equivalent type (e.g.: byte, wchar_t, etc.)

Recent advisories

GHSA-q2ww-5357-x388 — Rack has Content-Length mismatch in Rack::Files error responses

All advisories for CWE-135

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor