CVE-2026-33816: Function Call Go Cwe 000 Cve 2026 33816
A 4-byte wire-protocol length/count is read with binary.BigEndian.Uint32(...) and only widened with plain int(...) before it is used as a slice bound ($BUF[$X : $X + $N], $BUF[$N:] or $BUF[:$N]). Unsigned widening makes the value never negative, so the protocol's -1 NULL sentinel check can never match the real NULL encoding (0xFFFFFFFF) and no negative-lengt
Gogreprules fetch cve-2026-33816-function-call-go-cwe-000-cve-2026-33816 --engine opengrepDescription
A 4-byte wire-protocol length/count is read with binary.BigEndian.Uint32(...) and only widened with plain int(...) before it is used as a slice bound ($BUF[$X : $X + $N], $BUF[$N:] or $BUF[:$N]). Unsigned widening makes the value never negative, so the protocol's -1 NULL sentinel check can never match the real NULL encoding (0xFFFFFFFF) and no negative-lengt
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.