It can allow for security exploits, if the different layers of your stack handle invalid code units differently. There's a related issue with "non-shortest for

It can allow for security exploits, if the different layers of your stack handle invalid code units differently. There's a related issue with "non-shortest forms:" it's possible to encode the NUL character '\0' without actually using a null byte. This means that (for example) "round tripping" UTF-8 data can introduce a null byte, allowing for security exploits when mixed with C-style string processing.