The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as input terminators when they are sent to a downstream component.
View on MITREFor example, a "." in SMTP signifies the end of mail message data, whereas a null character can be used for the end of a string.
Developers should anticipate that terminators will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
No detection method information available for this CWE.
MFV. mail server does not properly identify terminator string to signify end of message, causing corruption, possibly in conjunction with off-by-one error.
View DetailsMFV. mail server does not properly identify terminator string to signify end of message, causing corruption, possibly in conjunction with off-by-one error.
View DetailsMail server does not quote end-of-input terminator if it appears in the middle of a message.
View DetailsCWE-147: Improper Neutralization of Input Terminators is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as input terminators when they are sent to a downstream component. For example, a "." in SMTP signifies the end of mail message data, whereas a null character can be used for the end of a string.
If exploited, CWE-147 (Improper Neutralization of Input Terminators) it can compromise Integrity, leading to outcomes such as Unexpected State.
Recommended mitigations for CWE-147 include: Developers should anticipate that terminators will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
CWE-147 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
MITRE documents real CVEs mapped to CWE-147, including CVE-2000-0319, CVE-2000-0320, CVE-2001-0996 and CVE-2002-0001. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
A CWE (Common Weakness Enumeration) like CWE-147 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.