CWE-130Improper Handling of Length Parameter Inconsistency

Abstraction: Base · CVEs in our corpus: 106

The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

If an attacker can manipulate the length parameter associated with an input such that it is inconsistent with the actual length of the input, this can be leveraged to cause the target application to behave in unexpected, and possibly, malicious ways. One of the possible motives for doing so is to pass in arbitrarily large input to the application. Another possible motivation is the modification of application state by including invalid data for subsequent properties of the application. Such weaknesses commonly lead to attacks such as buffer overflows and execution of arbitrary code.

Last updated: 20 August 2026 20:22 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 1 mapping(s) from 1 framework(s): CAPEC 1 (partial)

See the full cumulative-coverage rollup →

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.PS-06
SA-11 Developer Testing and Evaluation
SI-10 Information Input Validation

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V3.5.5
V4.2.1
V4.2.2

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2025-14847` KEV	8.5	7.5	0.8322	2025-12-19
`CVE-2022-2714`	7.4	9.8	0.0078	2022-09-06
`CVE-2024-39614`	7.3	7.5	0.2864	2024-07-10
`CVE-2026-43125`	7.3	9.8	0.0043	2026-05-06
`CVE-2021-36090`	6.9	7.5	0.1295	2021-07-13
`CVE-2026-42216`	6.9	9.1	0.0046	2026-05-07
`CVE-2021-35516`	6.8	7.5	0.1236	2021-07-13
`CVE-2021-35517`	6.8	7.5	0.1061	2021-07-13
`CVE-2022-1543`	6.8	8.8	0.0110	2022-04-29
`CVE-2021-20588`	6.6	7.5	0.0688	2021-02-19
`CVE-2026-22861`	6.6	8.8	0.0060	2026-01-13
`CVE-2019-3862`	6.5	7.3	0.0811	2019-03-21
`CVE-2026-22047`	6.5	8.8	0.0032	2026-01-07
`CVE-2026-22255`	6.5	8.8	0.0038	2026-01-08
`CVE-2022-20870`	6.4	8.6	0.0090	2022-10-10
`CVE-2026-22046`	6.4	8.8	0.0029	2026-01-07
`CVE-2026-5367`	6.4	8.6	0.0087	2026-04-24
`CVE-2021-20610`	6.3	7.5	0.0308	2021-12-01
`CVE-2024-38011`	6.3	8.0	0.0126	2024-07-09
`CVE-2021-43666`	6.2	7.5	0.0213	2022-03-24
`CVE-2022-36788`	6.2	8.1	0.0062	2023-04-20
`CVE-2024-37305`	6.2	8.2	0.0045	2024-06-17
`CVE-2024-37988`	6.2	8.0	0.0098	2024-07-09
`CVE-2024-37989`	6.2	8.0	0.0098	2024-07-09
`CVE-2024-38010`	6.2	8.0	0.0098	2024-07-09