CVE-2026-0708
Null Byte Injection in libucl Causes Remote DoS via Segmentation Fault
Publication date: 2026-03-17
Last updated on: 2026-03-17
Assigner: Fedora Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-0708 is a vulnerability in the libucl library that occurs when it processes Universal Configuration Language (UCL) input containing a key with an embedded null byte (\u0000). Specifically, when libucl operates in zero-copy parsing mode (UCL_PARSER_ZEROCOPY), the function ucl_object_emit attempts to emit the parsed object as JSON but incorrectly assumes keys are null-terminated strings. This leads to a segmentation fault (SEGV) due to invalid memory access during the emission phase.
The flaw causes the program to crash when handling specially crafted UCL input with embedded null bytes in keys, resulting in a denial of service (DoS) condition for the affected system.
How can this vulnerability impact me? :
This vulnerability can cause affected systems using libucl to crash unexpectedly when processing maliciously crafted UCL input containing embedded null bytes in keys. The crash is a segmentation fault leading to a denial of service (DoS), which means the system or application relying on libucl may become unavailable or stop functioning properly.
Since the vulnerability can be triggered remotely by providing crafted input, it poses a risk of service disruption without requiring privileged access.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by testing the libucl parser in zero-copy mode with specially crafted UCL input containing keys with embedded null bytes (\\u0000). A proof-of-concept input file (e.g., poc_input.ucl) containing a key like "AAAAA\\u0000BBBB" mapped to a value can be used to trigger the segmentation fault during parsing and emission.'}, {'type': 'paragraph', 'content': 'To detect the issue on your system, you can run a test program that initializes a UCL parser in UCL_PARSER_ZEROCOPY mode, parses the crafted input file, and attempts to emit the parsed object as JSON. If the program crashes with a segmentation fault, the vulnerability is present.'}, {'type': 'paragraph', 'content': 'While no specific network detection commands are provided, monitoring for crashes or segmentation faults in applications using libucl when processing UCL input with embedded null bytes can indicate exploitation attempts.'}] [2, 1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding the use of libucl in zero-copy parsing mode (UCL_PARSER_ZEROCOPY) with untrusted or external UCL input that may contain embedded null bytes in keys.
Additionally, applying patches or updates provided by libucl maintainers or your Linux distribution that fix this vulnerability is critical to prevent denial of service.
Monitoring and filtering UCL input to ensure it does not contain embedded null bytes in keys before parsing can also help mitigate the risk.