CWE · MITRE source
CWE-130Improper Handling of Length Parameter Inconsistency
The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
If an attacker can manipulate the length parameter associated with an input such that it is inconsistent with the actual length of the input, this can be leveraged to cause the target application to behave in unexpected, and possibly, malicious ways. One of the possible motives for doing so is to pass in arbitrarily large input to the application. Another possible motivation is the modification of application state by including invalid data for subsequent properties of the application. Such weaknesses commonly lead to attacks such as buffer overflows and execution of arbitrary code.
Last updated: 15 October 2026 07:26 UTC
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
| No NIST controls proposed yet. | |||
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2025-14847 KEV UPD | 8.5 | 7.5 | 0.8322 | 2025-12-19 |
CVE-2026-109390 | 7.6 | 9.8 | 0.0161 | 2026-10-12 |
CVE-2022-2714 UPD | 7.5 | 9.8 | 0.0087 | 2022-09-06 |
CVE-2024-39614 UPD | 7.3 | 7.5 | 0.2864 | 2024-07-10 |
CVE-2026-43125 UPD | 7.3 | 9.8 | 0.0043 | 2026-05-06 |
CVE-2026-42216 UPD | 7.0 | 9.1 | 0.0071 | 2026-05-07 |
CVE-2021-36090 UPD | 6.9 | 7.5 | 0.1295 | 2021-07-13 |
CVE-2021-35516 UPD | 6.8 | 7.5 | 0.1236 | 2021-07-13 |
CVE-2021-35517 UPD | 6.8 | 7.5 | 0.1061 | 2021-07-13 |
CVE-2022-1543 UPD | 6.8 | 8.8 | 0.0111 | 2022-04-29 |
CVE-2026-22861 | 6.7 | 8.8 | 0.0071 | 2026-01-13 |
CVE-2021-20588 UPD | 6.6 | 7.5 | 0.0688 | 2021-02-19 |
CVE-2026-58096 UPD | 6.6 | 8.8 | 0.0060 | 2026-08-26 |
CVE-2019-3862 UPD | 6.5 | 7.3 | 0.0790 | 2019-03-21 |
CVE-2026-22046 | 6.5 | 8.8 | 0.0034 | 2026-01-07 |
CVE-2026-22047 | 6.5 | 8.8 | 0.0038 | 2026-01-07 |
CVE-2026-22255 | 6.5 | 8.8 | 0.0042 | 2026-01-08 |
CVE-2021-20610 UPD | 6.4 | 7.5 | 0.0327 | 2021-12-01 |
CVE-2022-20870 UPD | 6.4 | 8.6 | 0.0099 | 2022-10-10 |
CVE-2026-5367 UPD | 6.4 | 8.6 | 0.0088 | 2026-04-24 |
CVE-2024-38011 UPD | 6.3 | 8.0 | 0.0126 | 2024-07-09 |
CVE-2021-43666 UPD | 6.2 | 7.5 | 0.0207 | 2022-03-24 |
CVE-2022-3272 UPD | 6.2 | 7.5 | 0.0177 | 2022-09-26 |
CVE-2022-36788 UPD | 6.2 | 8.1 | 0.0062 | 2023-04-20 |
CVE-2024-37305 UPD | 6.2 | 8.2 | 0.0045 | 2024-06-17 |