CWE-228 Improper Handling of Syntactically Invalid Structure
classThe product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (33)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-5381US | high7.5 | — | ||
The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgp_packet.c:bgp_capability_msg_parse function. The pars… | ||||
| CVE-2021-38443US | critical9.8 | — | ||
Eclipse CycloneDDS versions prior to 0.8.0 improperly handle invalid structures, which may allow an attacker to write arbitrary values in the XML parser. | ||||
| CVE-2020-27847US | critical9.8 | — | ||
A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authenticat… | ||||
| CVE-2026-9205US | critical9.8 | — | ||
IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function. | ||||
| CVE-2024-55594US | critical9.8 | — | ||
An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker… | ||||
| CVE-2023-42784US | critical9.8 | — | ||
An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker… | ||||
| CVE-2020-26290US | critical9.6 | — | ||
Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector.… | ||||
| CVE-2016-2572US | high7.5 | — | ||
http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure… | ||||
| CVE-2016-2571US | high7.5 | — | ||
http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with the storage of certain data after a response-parsing failure, which allows remote HTTP servers to cause a deni… | ||||
| CVE-2022-31116US | high7.5 | — | ||
UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings tha… | ||||
| CVE-2019-10691US | high7.5 | — | ||
The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate with an invalid UTF-8 sequence as the usern… | ||||
| CVE-2026-42100US | high7.5 | — | ||
Improper Handling of Syntactically Invalid Structure in Sparx Pro Cloud Server allows Denial of Service (DoS) attack to be executed by sending an specially crafted SQL query. This… | ||||
| CVE-2024-6382US | high7.5 | — | ||
Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data… | ||||
| CVE-2024-21612US | high7.5 | — | ||
An Improper Handling of Syntactically Invalid Structure vulnerability in Object Flooding Protocol (OFP) service of Juniper Networks Junos OS Evolved allows an unauthenticated,… | ||||
| CVE-2023-39914US | high7.5 | — | ||
NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the… | ||||
| CVE-2026-25657US | medium6.5 | — | ||
Ericsson Packet Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling of Syntactically Invalid Structure (CWE-228) vulnerability where an attacker continuously sen… | ||||
| CVE-2022-41783US | medium5.5 | — | ||
tdpServer of TP-Link RE300 V1 improperly processes its input, which may allow an attacker to cause a denial-of-service (DoS) condition of the product's OneMesh function. | ||||
| CVE-2024-53828US | medium5.3 | — | ||
Ericsson Packet Core Controller (PCC) versions prior
to 1.38 contain a vulnerability where an attacker sending a large volume of
specially crafted messages may cause service degrad… | ||||
| CVE-2021-36199US | medium5.3 | — | ||
Running a vulnerability scanner against VideoEdge NVRs can cause some functionality to stop. | ||||
| CVE-2025-2529US | low3.7 | — | ||
Applications using affected versions of Ehcache 3.x can experience degraded cache-write performance if the application using Ehcache utilizes keys sourced from (malicious) external… | ||||
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan