Bypassing character blocklists with unicode overflows
Summary: PortSwigger researcher Gareth Heyes published an article on Unicode codepoint truncation, also called a Unicode overflow attack, which occurs when a server tries to store a Unicode character in a single byte and an overflow can be crafted to produce a specific ASCII character such as 0x41, or "A". Heyes also notes that JavaScript's fromCharCode() method has a codepoint overflow, where a value above the 0xffff maximum produces a character by the overflow amount, and that the technique is being actively used by bug bounty hunters and was brought to the team's attention by Ryan Barnett.
Bottom line: Blocklists that filter on specific characters can be bypassed by codepoints that overflow into those same characters, so a control that looks like it blocks a payload may not - and bug bounty hunters are already using the technique.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026