diff --git a/core-bundle/src/Resources/contao/library/Contao/Input.php b/core-bundle/src/Resources/contao/library/Contao/Input.php
index <HASH>..<HASH> 100644
--- a/core-bundle/src/Resources/contao/library/Contao/Input.php
+++ b/core-bundle/src/Resources/contao/library/Contao/Input.php
@@ -462,6 +462,12 @@ class Input
 		$varValue = strip_tags($varValue, $strAllowedTags);
 		$varValue = str_replace(array('&lt;!--', '&lt;![', '--&gt;'), array('<!--', '<![', '-->'), $varValue);
 
+		// Recheck for encoded null bytes
+		while (strpos($varValue, '\\0') !== false)
+		{
+			$varValue = str_replace('\\0', '', $varValue);
+		}
+
 		return $varValue;
 	}
[Core] Fix another weakness in the `Input` class and further harden the `deserialize()` function

Fix another weakness in the `Input` class and further harden the `deserialize()` function. Thanks to Martin Auswöger for his input.