CWE-170— Improper Null Termination

The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.— MITRE CWE catalog

51 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-170page 2 of 2

CVE-2026-8721CRITICALCVSS 9.8EG 9.8
2026-05-17
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs. Password parameters in PKCS12.xs are declared char *, which routes through Perl's default typemap to SvPV_nolen. The Perl length is discarded.…

Map vulnerabilities like CWE-170 to your infrastructure

EchelonGraph correlates every CVE — across CWE-170 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →