Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

AIDE through 0.19.4 can ignore hash changes past a null byte

1 source · 2 articlesFirst reported Updated ()
What's new

October 22: the oss-security notice describes the null-byte hash bypass; no fix or CVE is named.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

AIDE 0.19.4 and earlier can treat a crafted file as unchanged when its hash matches through the first null byte; no CVE yet.

AIDE, a host-based file and directory integrity checker, improperly compares hash values that contain a null byte, according to a notice posted by Hannes von Haugwitz. Versions through 0.19.4 treat a file as unchanged if its hash matches the stored value through the first 0x00 byte, so the difference is silently ignored. A local user could use that to bypass detection of malicious files. The issue is tracked as GHSA-6wc9-4w69-5jc5. No fixed version is stated, and a CVE is still pending.

Key facts
  • Affected versions are AIDE 0.19.4 and earlier.
  • Hash comparison is unreliable at the first null byte.
  • Advisory identifier is GHSA-6wc9-4w69-5jc5.
  • No CVE number has been assigned.
  • Hannes von Haugwitz posted the notice on October 22.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 22, 2026Null-byte hash comparison bypass disclosed · oss-security

What each outlet adds

beyond the shared facts
  • oss-securityNames GHSA-6wc9-4w69-5jc5 and the pending CVE status.
Vendors
AIDE
Products
AIDE

Coverage

oldest first · one row per article · UTC
  1. · 3d ago oss-securityFirst report

    AIDE 0.16 through 0.19.4 ignores invalid UTF-8 file names

    A local user can hide files or directories from the integrity checker; a CVE is still pending.

  2. · 3d ago oss-security

    AIDE through 0.19.4 can ignore hashes containing a null byte

    A local user can match a stored hash up to the first 0x00 byte and hide a changed file.