Weaknesses of type CWE-436

159 results

Conflito de Interpretação

Fraqueza em que diferentes componentes de um sistema interpretam a mesma entrada ou dado de forma diferente, causando inconsistência lógica. Um atacante explora essa divergência para contornar validações em um componente enquanto consegue efeito diferente em outro, comprometendo a segurança geral.

Example

Um firewall valida uma URL como segura interpretando-a de uma forma, mas o navegador a interpreta diferentemente e acessa um endpoint malicioso. Ou um validador servidor rejeita um caminho com '..' enquanto outro componente o normaliza de forma distinta, permitindo path traversal.

How to mitigate

Padronize a interpretação: use bibliotecas de parsing e normalização comuns entre todos os componentes, valide em múltiplas camadas com a mesma lógica, e teste casos de borda onde diferentes interpretadores possam divergir (encoding, caracteres especiais, formatos ambíguos).

CVE-2026-116695MEDIUMCrass: Incorrect tokenization of bad URLs enables CSS sanitizer bypassEPSS 0.4%CVE-2026-42551HIGHFlight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/coreEPSS 0.4%CVE-2026-119200MEDIUMNuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routesEPSS 0.3%CVE-2026-45066LOWSymfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> MisclassificationEPSS 0.3%CVE-2026-114104HIGHadm-zip before 0.6.1 Duplicate ZIP Entry Name Validation BypassEPSS 0.3%CVE-2026-56329MEDIUMCapgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore DecodingEPSS 0.3%CVE-2026-18246LOWIBM i is Affected By security restrictions bypass in Navigator for iEPSS 0.3%CVE-2026-41248CRITICALOfficial Clerk JavaScript SDKs: Middleware-based route protection bypassEPSS 0.3%CVE-2026-107825MEDIUMOWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrationsEPSS 0.3%CVE-2026-115905CRITICALzip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCEEPSS 0.3%CVE-2026-59882MEDIUMguzzlehttp/psr7: Host Confusion via Weak URI Host ValidationEPSS 0.3%CVE-2026-112712CRITICAL@fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatchEPSS 0.3%CVE-2026-106505HIGHBackstage: Bypass of MkDocs configuration sanitizer in TechDocs backendEPSS 0.3%CVE-2026-48788HIGHRemark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofingEPSS 0.3%CVE-2023-22998MEDIUMIn the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expectsEPSS 0.3%CVE-2026-42273HIGHHeimdall: Case-sensitive host matching may lead to policy bypassEPSS 0.3%CVE-2026-107835MEDIUMOWASP Coraza WAF: Cookie Parser ConfusionEPSS 0.3%CVE-2026-32065MEDIUMOpenClaw < 2026.2.25 - Approval Identity Mismatch in system.run Command ExecutionEPSS 0.3%CVE-2026-44576MEDIUMNext.js: Cache poisoning in React Server Component responsesEPSS 0.3%CVE-2026-27896HIGHMCP Go SDK Vulnerable to Improper Handling of Case SensitivityEPSS 0.3%