CWE-158 (空字节或NULL字符转义处理不恰当) — Vulnerability Class 21

CWE-158 represents a critical input validation weakness where software fails to properly handle null bytes or NUL characters within user-supplied data. This flaw typically arises when applications process strings that are terminated by null characters in certain programming languages, such as C or C++, leading to premature string termination. Attackers exploit this by injecting null bytes into input fields, effectively truncating the intended command or path before it reaches downstream components. This manipulation can bypass security checks, enable path traversal attacks, or cause unexpected application behavior by altering how data is interpreted. To mitigate this risk, developers must implement rigorous input sanitization that explicitly validates and strips null characters before processing. Additionally, using modern, null-aware string libraries and enforcing strict data type constraints can prevent misinterpretation, ensuring that all input is handled consistently and securely across the entire application lifecycle.