CWE-476: NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

Consequences

• Availability: DoS: Crash, Exit, or Restart
• Integrity, Confidentiality: Execute Unauthorized Code or Commands, Read Memory, Modify Memory

How to prevent it

• Implementation: For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
• Requirements: Select a programming language that is not susceptible to these issues.
• Implementation: Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
• Architecture and Design: Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
• Implementation: Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.

Recent advisories

• GHSA-525v-9gp9-w22h — Forge: TLS client crash when the server sends no certificate
• GHSA-8hrf-8g6f-7xwp — Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
• GHSA-cp9v-662q-vvx9 — Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
• GHSA-27h8-gf7j-v5hc — Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
• GHSA-3x6r-wxxg-53vv — rclone: Infinite Scale TUS Creation Transport Error Causes a Nil-Response Panic
• GHSA-m932-crvm-gcp5 — Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
• GHSA-qh5g-q395-cx4j — ImageMagick: Heap-use-after-free via XMP profile could result in a crash
• GO-2026-5810 — Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)
• GO-2026-5800 — Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}
• GHSA-9cv2-cfxc-v4v2 — Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes
• GHSA-p9rq-q46c-g4x6 — ImageMagick has Null Pointer Dereference caused by the distort operation when passing incorrect arguments
• GO-2026-5252 — Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted)
• GHSA-rm5c-5x2p-48wr — Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt
• GHSA-78mq-xcr3-xm33 — golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow
• GHSA-9r33-xhw8-4qqp — HAX CMS: Denial of Service using Malicious Import Request

All advisories for CWE-476