Also known as: length manipulation, length tampering
The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
Last updated
If an attacker can manipulate the length parameter associated with an input such that it is inconsistent with the actual length of the input, this can be leveraged to cause the target application to behave in unexpected, and possibly, malicious ways. One of the possible motives for doing so is to pass in arbitrarily large input to the application. Another possible motivation is the modification of application state by including invalid data for subsequent properties of the application. Such weaknesses commonly lead to attacks such as buffer overflows and execution of arbitrary code.
101 recorded CVEs are caused by CWE-130 (Improper Handling of Length Parameter Inconsistency), including 1 in CISA's KEV (Known Exploited Vulnerabilities) catalog. KEVs are shown first. 35 new CWE-130 CVEs have been recorded so far in 2026 (14 in 2025).
Zlib compressed protocol header length confusion may allow memory read
dlm: validate length in dlm_search_rsb_tree
FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure
rxrpc: fix oversized RESPONSE authenticator length check
websocket-driver: Message corruption via abuse of protocol length headers
Invalid IP packets cause a kernel panic
Buffer overflow in Bluetooth Mesh SDK when handling extended advertisements
ppp(8): missing length validation in LcpDecodeConfig()
Showing 12 of 101 recorded CWE-130 CVEs. Track new ones as they are published and get AI-written analysis and fixes.
Monitor CWE-130 vulnerabilitiesWhat can happen when CWE-130 is exploited.
Read Memory, Modify Memory, Varies by Context
Affects: Confidentiality, Integrity
Typically introduced during these phases of the software lifecycle.
Languages
Practical mitigations for CWE-130, grouped by where in the lifecycle they apply.
When processing structured incoming data containing a size field followed by raw data, ensure that you identify and resolve any inconsistencies between the size field and the actual size of the data.
Do not let the user control the size of the buffer.
Validate that the length of the user-supplied data is consistent with the buffer size.
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Illustrative examples from MITRE showing how the weakness appears in code.
In the following C/C++ example the method processMessageFromSocket() will get a message from a socket, placed into a buffer, and will parse the contents of the buffer into a structure that contains the message length and the message body. A for loop is used to copy the message body into a local character string which will be passed to another method for processing.
Vulnerable example
int processMessageFromSocket(int socket) {However, the message length variable (msgLength) from the structure is used as the condition for ending the for loop without validating that msgLength accurately reflects the actual length of the message body (CWE-606). If msgLength indicates a length that is longer than the size of a message body (CWE-130), then this can result in a buffer over-read by reading past the end of the buffer (CWE-126).
Real CVEs that MITRE cites as examples of this weakness.
CAPEC attack patterns that exploit this weakness.
Common questions about CWE-130.
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Get alerted the moment a new CWE-130 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.