Weaknesses of type CWE-436

115 results

Conflito de Interpretação

Fraqueza em que diferentes componentes de um sistema interpretam a mesma entrada ou dado de forma diferente, causando inconsistência lógica. Um atacante explora essa divergência para contornar validações em um componente enquanto consegue efeito diferente em outro, comprometendo a segurança geral.

Example

Um firewall valida uma URL como segura interpretando-a de uma forma, mas o navegador a interpreta diferentemente e acessa um endpoint malicioso. Ou um validador servidor rejeita um caminho com '..' enquanto outro componente o normaliza de forma distinta, permitindo path traversal.

How to mitigate

Padronize a interpretação: use bibliotecas de parsing e normalização comuns entre todos os componentes, valide em múltiplas camadas com a mesma lógica, e teste casos de borda onde diferentes interpretadores possam divergir (encoding, caracteres especiais, formatos ambíguos).

CVE-2026-25223HIGHFastify's Content-Type header tab character allows body validation bypassEPSS 0.8%CVE-2023-36456HIGHAuthentik lacks Proxy IP headers validationEPSS 0.8%CVE-2023-30536MEDIUMInsecure header validation in slim/psr7EPSS 0.7%CVE-2025-12816HIGHCVE-2025-12816EPSS 0.7%CVE-2026-47767HIGHSymfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv MismatchEPSS 0.7%CVE-2024-38428CRITICALurl.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in whiEPSS 0.7%CVE-2022-0011MEDIUMPAN-OS: URL Category Exceptions Match More URLs Than Intended in URL FilteringEPSS 0.7%CVE-2022-29254LOWFailed payment recorded has completed in silverstripe/silverstripe-omnipayEPSS 0.7%CVE-2026-56669HIGHElysia: Inefficient Algorithmic Complexity and Interpretation ConflictEPSS 0.6%CVE-2024-24754LOWBref Body Parsing Inconsistency in Event-Driven FunctionsEPSS 0.6%CVE-2026-17084MEDIUMstringprep.map_table_b2() deviates from RFC 3454 Table B.2EPSS 0.6%CVE-2022-36048MEDIUMIP address leak via image proxy bypass in Zulip ServerEPSS 0.6%CVE-2024-34478HIGHbtcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failuEPSS 0.6%CVE-2026-8034HIGHServer-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusionEPSS 0.5%CVE-2026-14198CRITICAL@fastify/middie vulnerable to authorization bypass via encoded slash in path parameter valuesEPSS 0.5%CVE-2023-22735MEDIUMUser uploads proxied from S3 lack `Content-Security-Policy` headers, may be served with `Content-Disposition: inline` in zulipEPSS 0.5%CVE-2026-6322HIGHfast-uri vulnerable to host confusion via percent-encoded authority delimitersEPSS 0.5%CVE-2026-40165HIGHauthentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier TruncationEPSS 0.5%CVE-2026-6270CRITICAL@fastify/middie vulnerable to middleware authentication bypass in child plugin scopesEPSS 0.5%CVE-2025-24013MEDIUMCodeIgniter validation of header name and valueEPSS 0.5%