CVE-2026-105475

Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data...

CVE-2026-116130

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

CLEANSTART-2024-WU84406 Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows

Security vulnerability affects the go package. Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows...

CVE-2026-116130

The HTTP::Parser::XS module for Perl, in versions before 0.18 , is vulnerable to a Null Byte Interaction Error (CWE-626) . The XS parser URL-decodes the request path and uses strlen() to measure the result, causing PATH_INFO to be truncated at the first byte decoded from %00 . This issue specific...

PT-2026-133523

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH INFO at an encoded NUL byte in parse http request. The XS parser URL-decodes the request path and measures the result with strlen, so PATH INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote...

CVE-2026-118767 Botan: Python binding bcrypt APIs truncate passwords containing embedded NULs

Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containing U+0000 to const char values without consistently rejecting the embedded NUL, causing bcrypt and checkbcrypt to process only the prefix before the NUL. Applications could...

CVE-2026-118767

The Botan C++ cryptography library (versions 1.11.22 through 3.13.0) contains a vulnerability in its Python binding where strings containing U+0000 (NUL) characters are converted to const char* without consistent rejection. This causes the bcrypt and check_bcrypt APIs to process only the prefix b...

CVE-2026-118767 Botan: Python binding bcrypt APIs truncate passwords containing embedded NULs

Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containing U+0000 to const char values without consistently rejecting the embedded NUL, causing bcrypt and checkbcrypt to process only the prefix before the NUL. Applications could...

CVE-2026-118767 Botan: Python binding bcrypt APIs truncate passwords containing embedded NULs

Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containing U+0000 to const char values without consistently rejecting the embedded NUL, causing bcrypt and checkbcrypt to process only the prefix before the NUL. Applications could...

BIT-NODE-MIN-2026-105482

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...

BIT-NODE-2026-105482

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...

CLEANSTART-2026-QO42265 Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)

CVE-2026-39836 affects multiple packages. The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL 0. See references for individual vulnerability details...

HFS CVE-2014-6287 search macro RCE

CVE-2014-6287 HttpFileServer 2.3–2.3c: NUL-byte desync in the search handler allows .exec|cmd. macro execution without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Rejetto HFS CVE-2014-6287 unauthenticated search macro command execution.""" from future import annotations from...

Node.js 26.12.0 DNS Resolution NUL-Name Truncation

Node.js versions before 22.23.4, 24.22.1, and 26.12.1 contain a DNS resolution NUL-name truncation issue. The supplied offline Python tool assesses operator-provided version evidence...

Node.js 26.x DNS Resolution NUL-Name Truncation

Node.js versions 22.x, 24.x, and 26.x contain a DNS resolution NUL-name truncation flaw in dns.resolve and dns.reverse that may resolve a hostname different from the one an application validated. This archive provides research and remediation details...

Exploit for CVE-2026-105482

node-cve-2026-105482-check Standal...

ALPINE-CVE-2026-105482

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...

AZL-111035 CVE-2026-105482 affecting package nodejs for versions less than 24.22.1-0

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...

DEBIAN-CVE-2026-105482

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...

CVE-2026-105482

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...