# Stale memory returned to client

Length or presence checks that send allocated or uninitialized bytes instead of actual written data

_Area: Network devices and IoT. Seen in 3 disclosed reports; latest 2026-03-29. Updated 2026-10-23._

## How it works
Code builds a response from a buffer but reports the wrong length to the send path. Two assumptions break: (1) that a length-returning function's return value equals bytes actually placed in the buffer, and (2) that a parameter being present means it has a usable value. When either fails, the send routine transmits bytes past the initialized region, exposing whatever was in memory: session tokens, cookies, heap residue.

## Where it shows up
- `snprintf`/`strlcpy` return value (would-have-written length) passed as a send or copy length instead of the actual written count [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-citrix-bleed-leaking-session-tokens-with-cve-2023-4966.md)
- Decompressors returning allocated buffer size rather than actual decompressed length [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-mongobleed-cve-2025-14847-exploited-in-the-wild-mongodb.md)
- Query/header parameters checked only for presence, not for an `=` or non-empty value, then dereferenced [E3](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part.md)
- Pre-auth endpoints: OAuth/OpenID discovery, SAML/WS-Fed handlers, compression layers processed before authentication [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-citrix-bleed-leaking-session-tokens-with-cve-2023-4966.md)[E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-mongobleed-cve-2025-14847-exploited-in-the-wild-mongodb.md)[E3](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part.md)
- Responses that echo attacker-influenced headers (e.g. Host) into a fixed-size buffer [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-citrix-bleed-leaking-session-tokens-with-cve-2023-4966.md)

## How to review
For every send/write, trace where the length argument comes from. The invariant: the length passed to the transport must equal the number of bytes actually initialized in the buffer, never a would-be length, allocated capacity, or struct field. For parsers, confirm the returned length is the consumed/produced count, not the buffer size. For parameter handling, confirm the code validates that a value exists and is non-empty before dereferencing, not merely that the key is present. Check pre-auth reachability first; those paths carry the most risk.

## Variants seen
- Misused `snprintf` return length on an unauthenticated OpenID config endpoint, leaking session tokens [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-citrix-bleed-leaking-session-tokens-with-cve-2023-4966.md)
- Decompressor returning allocated size, causing uninitialized heap parsed as BSON pre-auth [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-mongobleed-cve-2025-14847-exploited-in-the-wild-mongodb.md)
- Presence-only check on `wctx` returning uninitialized memory base64-encoded in a cookie [E3](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part.md)

## Why fixes fail
Vendors bundled multiple overreads under one CVE; sibling SAML/WS-Fed endpoints retained the same presence-vs-value flaw after the first patch [E3](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part.md). Fixing one call site leaves the pattern elsewhere.

## Impact and severity
Unauthenticated memory disclosure of session tokens and admin session IDs enables session hijacking; MongoBleed was exploited in the wild [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-mongobleed-cve-2025-14847-exploited-in-the-wild-mongodb.md). Severity is high because the leaks are pre-auth and yield credentials directly. Worse when the leaked region is reused across requests or holds long-lived tokens.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-citrix-bleed-leaking-session-tokens-with-cve-2023-4966.md
- E2: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-mongobleed-cve-2025-14847-exploited-in-the-wild-mongodb.md
- E3: https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part.md