Please, it can happen in any language, it depends on how you write it. If you do not sanitize your inputs you get sql-injected, and is this fault of SQL or you? I agree it is harder to write C code safely, but this was a stupid bug, not actually a C incompetence. You could allocate a large buffer in Java, and you could use `System.arraycopy(array, 0, part, 0, size);` instead of OpenSSL: `memcpy(bp, pl, payload);` both lacks only a boundary check and language provided checks will not help you in Java. Java is given as an example language that provides boundary checks. It applies to others as well.