CWE-130 Base Incompleto

Improper Handling of Length Parameter Inconsistency

This vulnerability occurs when a program reads a structured data packet or message but fails to properly validate that the declared length field matches the actual amount of data provided.

Definición

What is CWE-130?

This vulnerability occurs when a program reads a structured data packet or message but fails to properly validate that the declared length field matches the actual amount of data provided.
Attackers exploit this flaw by deliberately sending data where the stated length is incorrect—either longer or shorter than the real payload. This inconsistency tricks the application's parsing logic, often leading to catastrophic security failures like buffer overflows, memory corruption, or the processing of garbage data as if it were legitimate instructions. In practice, an attacker might use a manipulated length field to inject massive amounts of data beyond allocated buffers or to carefully craft input that alters critical application state. The core defense is for developers to always independently calculate or strictly verify data lengths during parsing, never trusting the user-supplied length parameter alone before processing the associated data block.
Impacto en el mundo real

Real-world CVEs caused by CWE-130

  • CVE-2014-0160

    Chain: "Heartbleed" bug receives an inconsistent length parameter (CWE-130) enabling an out-of-bounds read (CWE-126), returning memory that could include private cryptographic keys and other sensitive data.

  • CVE-2009-2299

    Web application firewall consumes excessive memory when an HTTP request contains a large Content-Length value but no POST data.

  • CVE-2001-0825

    Buffer overflow in internal string handling routine allows remote attackers to execute arbitrary commands via a length argument of zero or less, which disables the length check.

  • CVE-2001-1186

    Web server allows remote attackers to cause a denial of service via an HTTP request with a content-length value that is larger than the size of the request, which prevents server from timing out the connection.

  • CVE-2001-0191

    Service does not properly check the specified length of a cookie, which allows remote attackers to execute arbitrary commands via a buffer overflow, or brute force authentication by using a short cookie length.

  • CVE-2003-0429

    Traffic analyzer allows remote attackers to cause a denial of service and possibly execute arbitrary code via invalid IPv4 or IPv6 prefix lengths, possibly triggering a buffer overflow.

  • CVE-2000-0655

    Chat client allows remote attackers to cause a denial of service or execute arbitrary commands via a JPEG image containing a comment with an illegal field length of 1.

  • CVE-2004-0492

    Server allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative Content-Length HTTP header field causing a heap-based buffer overflow.

Cómo lo explotan los atacantes

Ruta del atacante paso a paso

  1. 1

    Identifica una ruta de código que maneje entrada no confiable sin validación.

  2. 2

    Crea un payload que ejercite el comportamiento inseguro — inyección, traversal, overflow o abuso de lógica.

  3. 3

    Envía el payload a través de una solicitud normal y observa la reacción de la aplicación.

  4. 4

    Itera hasta que la respuesta filtre datos, ejecute código del atacante o escale privilegios.

Ejemplo de código vulnerable

Vulnerable C

In the following C/C++ example the method processMessageFromSocket() will get a message from a socket, placed into a buffer, and will parse the contents of the buffer into a structure that contains the message length and the message body. A for loop is used to copy the message body into a local character string which will be passed to another method for processing.

Vulnerable C 
int processMessageFromSocket(int socket) {
  		int success;
  		char buffer[BUFFER_SIZE];
  		char message[MESSAGE_SIZE];
```
// get message from socket and store into buffer* 
  		
  		
  		 *//Ignoring possibliity that buffer > BUFFER_SIZE* 
  		if (getMessage(socket, buffer, BUFFER_SIZE) > 0) {
  		```
```
// place contents of the buffer into message structure* 
  				ExMessage *msg = recastBuffer(buffer);
  				
  				
  				 *// copy message body into string for processing* 
  				int index;
  				for (index = 0; index < msg->msgLength; index++) {
  				```
  					message[index] = msg->msgBody[index];
  				}
  				message[index] = '\0';
```
// process message* 
  				success = processMessage(message);}
  		return success;}
Ejemplo de código seguro

Secure pseudo

Seguro pseudo 
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
  const safe = validateAndEscape(input);
  return executeWithGuards(safe);
}
What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Lista de prevención

How to prevent CWE-130

  • Implementation When processing structured incoming data containing a size field followed by raw data, ensure that you identify and resolve any inconsistencies between the size field and the actual size of the data.
  • Implementation Do not let the user control the size of the buffer.
  • Implementation Validate that the length of the user-supplied data is consistent with the buffer size.
Señales de detección

How to detect CWE-130

SAST High

Ejecuta análisis estático (SAST) sobre el código buscando el patrón inseguro en el flujo de datos.

DAST Moderate

Ejecuta pruebas dinámicas de seguridad de aplicaciones (DAST) contra el endpoint en vivo.

Runtime Moderate

Vigila los logs en tiempo de ejecución para detectar trazas de excepción inusuales, entradas malformadas o intentos de bypass de autorización.

Code review Moderate

Revisión de código: marca cualquier código nuevo que maneje entrada desde esta superficie sin usar los helpers validados del framework.

Auto-corrección de Plexicus

Plexicus detecta automáticamente CWE-130 y abre un PR de corrección en menos de 60 segundos.

Codex Remedium escanea cada commit, identifica esta debilidad concreta y entrega un pull request listo para revisión con el parche. Sin tickets. Sin traspasos.

Solicitar demo Probar Plexicus gratis
Preguntas frecuentes

Frequently asked questions

¿Qué es CWE-130?

This vulnerability occurs when a program reads a structured data packet or message but fails to properly validate that the declared length field matches the actual amount of data provided.

¿Qué gravedad tiene CWE-130?

MITRE no ha publicado una calificación de probabilidad de explotación para esta debilidad. Trátala como de impacto medio hasta que tu modelo de amenazas demuestre lo contrario.

¿Qué lenguajes o plataformas se ven afectados por CWE-130?

MITRE lists the following affected platforms: C, C++.

¿Cómo puedo prevenir CWE-130?

When processing structured incoming data containing a size field followed by raw data, ensure that you identify and resolve any inconsistencies between the size field and the actual size of the data. Do not let the user control the size of the buffer.

¿Cómo detecta y corrige Plexicus CWE-130?

El motor SAST de Plexicus detecta la firma de flujo de datos para CWE-130 en cada commit. Cuando hay coincidencia, nuestro agente Codex Remedium abre un PR de corrección con el código corregido, las pruebas y un resumen de una línea para el revisor.

¿Dónde puedo aprender más sobre CWE-130?

MITRE publica la definición canónica en https://cwe.mitre.org/data/definitions/130.html. También puedes consultar la documentación de OWASP y NIST para guías relacionadas.

Debilidades relacionadas

Weaknesses related to CWE-130

CWE-240 Padre

Improper Handling of Inconsistent Structural Elements

This vulnerability occurs when a system fails to properly manage situations where related data structures or elements should match but are…

CWE-805 Puede preceder

Buffer Access with Incorrect Length Value

This vulnerability occurs when software reads from or writes to a buffer using a loop or sequential operation, but mistakenly calculates…

Recursos

Further reading

Listo cuando tú lo estés

Deja de pagar por desarrollador.
Empieza a cerrar el bucle.

Plexicus es el ASPM nativo de IA que escanea, filtra, corrige, pentestea y explica — de forma autónoma. Desarrolladores ilimitados, repos ilimitados, acciones de IA de uso justo. Nivel gratuito real, €269/mo anual cuando estés listo.

Comenzar gratis Reservar una demo