CWE-135: Incorrect Calculation of Multi-Byte String Length
Overview
CWE-135 (Incorrect Calculation of Multi-Byte String Length) documents a weakness type used across vulnerability databases and security assessments. Use the sections below for definition, context, and mapped CVEs.
Security impact
Security impact: Depends on product and context; use CVE records, severity scores, and MITRE guidance to prioritize.
Description
The product does not correctly calculate the length of strings that can contain wide or multi-byte characters.
Applicable platforms
Kind
Name
Class
Prevalence
OS / CPE
language
C
—
Undetermined
—
language
C++
—
Undetermined
—
Related CVEs in this database
These CVEs are mapped to this weakness in this database and kept for traceability and search.
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Files#fail sets the Content-Length response header using String#size instead of String#bytesize. When th…
A flaw was found in gix-date. The `gix_date::parse::TimeBuf::as_str` function can generate strings containing invalid non-UTF8 characters. This issue violates the internal safety invariants of the `Ti…