Weaknesses of type CWE-176

43 results

Manipulação inadequada de codificação Unicode em entrada

A aplicação não valida ou processa corretamente dados que chegam em codificação Unicode, permitindo que caracteres especiais, normalizações alternativas ou sequências malformadas contornem filtros de segurança ou causem comportamento inesperado. Atacantes exploram variações de Unicode (como composição/decomposição de caracteres ou caracteres invisíveis) para burlar validações que assumem ASCII ou uma forma fixa de encoding.

Example

Um WAF bloqueia a string 'union select' em queries SQL, mas não detecta quando um atacante envia 'unﻰion select' usando caracteres Unicode que visualmente são idênticos, ou envia '// comentário' onde a barra tem código Unicode alternativo que a aplicação interpreta diferente do WAF.

How to mitigate

Normalize toda entrada Unicode para uma forma canônica (NFD ou NFC) antes de validar; use listas brancas explícitas de caracteres permitidos em campos críticos; configure tratamento de erro para rejeitar sequências malformadas em vez de ignora-las silenciosamente.

CVE-2023-31169MEDIUMImproper Handling of Unicode EncodingEPSS 0.4%CVE-2026-110687HIGHCpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmpEPSS 0.4%CVE-2026-93990HIGHExpat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked SurrogateEPSS 0.4%CVE-2026-93751MEDIUMuri-js through 4.4.1 Improper UTF-8 Decoding via pctDecCharsEPSS 0.4%CVE-2026-86105MEDIUMFireware OS Improper Authorization in Access Portal Reverse ProxyEPSS 0.3%CVE-2026-44288MEDIUMprotobufjs: Overlong UTF-8 decodingEPSS 0.3%CVE-2025-55129MEDIUMHackerOne community member Kassem S.(kassem_s94) has reported that username handling in Revive Adserver was still vulnerable to impersonatioEPSS 0.3%CVE-2026-23950HIGHnode-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFSEPSS 0.3%CVE-2017-20190—Some Microsoft technologies as used in Windows 8 through 11 allow a temporary client-side performance degradation during processing of multiEPSS 0.3%CVE-2025-59547MEDIUMDNN's CKEditor File Uploader functionality vulnerable through Unicode obfuscationEPSS 0.3%CVE-2026-114114MEDIUMVyper through 0.5.0b1 Literal Value Substitution via Multi-byte CharactersEPSS 0.3%CVE-2026-20202MEDIUMImproper Input Validation during User Account Creation in Splunk EnterpriseEPSS 0.2%CVE-2026-19954MEDIUMNet::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain namesEPSS 0.2%CVE-2026-62374HIGHSD JWT JS: Tampered disclosures silently dropped instead of rejectedEPSS 0.2%CVE-2026-116542MEDIUMNetty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 DecodingEPSS 0.2%CVE-2024-8067MEDIUMUnicode "best fit" argument injectionEPSS 0.2%CVE-2026-49401HIGHDeno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)EPSS 0.2%CVE-2022-29812LOWIn JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode directionality formatting characters were insufficientEPSS 0.2%CVE-2026-81869MEDIUMOpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncationEPSS 0.2%CVE-2026-35346LOWuutils coreutils comm Silent Data Corruption via Lossy UTF-8 NormalizationEPSS 0.2%