CWE · MITRE source
CWE-158Improper Neutralization of Null Byte or NUL Character
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.
As data is parsed, an injected NUL character or null byte may cause the product to believe the input is terminated earlier than it actually is, or otherwise cause the input to be misinterpreted. This could then be used to inject potentially dangerous input that occurs after the null byte or otherwise bypass validation routines and other protection mechanisms.
Last updated: 11 August 2026 14:55 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 2 mapping(s) from 1 framework(s): CAPEC 2 (partial)
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
—
—
V1.2.10
NIST 800-53 r5 controls that address this weakness (0)AI-assisted
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
| No NIST controls proposed yet. | |||
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2025-47812 KEV UPD | 10.0 | 10.0 | 0.9549 | 2025-07-10 |
CVE-2009-1537 KEV UPD | 9.2 | 8.8 | 0.5121 | 2009-05-29 |
CVE-2020-14500 UPD | 7.7 | 10.0 | 0.0167 | 2020-08-25 |
CVE-2025-14388 UPD | 7.3 | 9.8 | 0.0043 | 2025-12-23 |
CVE-2022-20812 UPD | 6.7 | 9.0 | 0.0184 | 2022-07-06 |
CVE-2022-20813 UPD | 6.6 | 9.0 | 0.0105 | 2022-07-06 |
CVE-2023-5719 UPD | 6.6 | 8.8 | 0.0051 | 2023-11-06 |
CVE-2025-55113 UPD | 6.2 | 9.0 | 0.0027 | 2025-09-16 |
CVE-2026-33191 | 6.2 | 8.6 | 0.0035 | 2026-03-20 |
CVE-2020-5363 UPD | 6.0 | 8.6 | 0.0032 | 2020-06-10 |
CVE-2025-66263 UPD | 5.8 | 7.5 | 0.0038 | 2025-11-26 |
CVE-2025-1936 UPD | 5.7 | 7.3 | 0.0043 | 2025-03-04 |
CVE-2020-7928 UPD | 5.4 | 6.5 | 0.0141 | 2020-11-23 |
CVE-2024-10921 UPD | 5.3 | 6.8 | 0.0054 | 2024-11-14 |
CVE-2026-23863 UPD | 5.1 | 6.5 | 0.0053 | 2026-05-01 |
CVE-2026-70603 | 4.4 | 6.0 | 0.0010 | 2026-08-05 |
CVE-2024-0408 UPD | 4.3 | 5.5 | 0.0032 | 2024-01-18 |
CVE-2026-41256 UPD | 4.2 | 5.5 | 0.0016 | 2026-05-11 |
CVE-2026-43895 UPD | 3.5 | 4.4 | 0.0016 | 2026-05-11 |
CVE-2026-47778 | 3.4 | 4.4 | 0.0018 | 2026-06-26 |
CVE-2026-28540 | 3.1 | 4.0 | 0.0008 | 2026-03-05 |
CVE-2026-43859 UPD | 3.1 | 3.7 | 0.0016 | 2026-05-04 |
CVE-2026-43861 UPD | 3.1 | 3.7 | 0.0016 | 2026-05-04 |
CVE-2024-9026 UPD | 3.0 | 3.3 | 0.0048 | 2024-10-08 |
CVE-2025-61985 UPD | 2.8 | 3.6 | 0.0011 | 2025-10-06 |