Weaknesses of type CWE-436

159 results

Conflito de Interpretação

Fraqueza em que diferentes componentes de um sistema interpretam a mesma entrada ou dado de forma diferente, causando inconsistência lógica. Um atacante explora essa divergência para contornar validações em um componente enquanto consegue efeito diferente em outro, comprometendo a segurança geral.

Example

Um firewall valida uma URL como segura interpretando-a de uma forma, mas o navegador a interpreta diferentemente e acessa um endpoint malicioso. Ou um validador servidor rejeita um caminho com '..' enquanto outro componente o normaliza de forma distinta, permitindo path traversal.

How to mitigate

Padronize a interpretação: use bibliotecas de parsing e normalização comuns entre todos os componentes, valide em múltiplas camadas com a mesma lógica, e teste casos de borda onde diferentes interpretadores possam divergir (encoding, caracteres especiais, formatos ambíguos).

CVE-2026-53537LOWPython-Multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parametersEPSS 0.3%CVE-2026-47344LOWTYPO3 HTML Sanitizer allows Cross-Site ScriptingEPSS 0.3%CVE-2026-33804HIGH@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes optionEPSS 0.3%CVE-2026-87627MEDIUMInterpretation conflict in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker leveraging social engineEPSS 0.3%CVE-2026-118517LOWSymfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for CVE-2026-45066)EPSS 0.3%CVE-2026-26961LOWRack: Multipart Boundary Parsing Ambiguity allowing WAF BypassEPSS 0.3%CVE-2026-114116MEDIUMVyper through 0.5.0b1 Literal Value Manipulation via Line SeparatorsEPSS 0.3%CVE-2026-32766LOWastral-tokio-tar insufficiently validates PAX extensions during extractionEPSS 0.3%CVE-2026-116137MEDIUMadm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent NamesEPSS 0.3%CVE-2026-53538LOWPython-Multipart: Semicolon treated as querystring field separator enables parameter smugglingEPSS 0.3%CVE-2026-110180MEDIUMfast-uri vulnerable to host confusion via unchecked WHATWG host canonicalizationEPSS 0.3%CVE-2026-121135HIGHSecurity issue in Platform in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML EPSS 0.3%CVE-2026-86818MEDIUMfast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronizationEPSS 0.3%CVE-2026-30246MEDIUMgithub.com/gofiber/fiber/v3 cache middleware can mix responses across query parametersEPSS 0.3%CVE-2026-27444HIGHHeader Email Address ParsingEPSS 0.2%CVE-2026-119190HIGHForge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13EPSS 0.2%CVE-2026-42177MEDIUMlinux-entra-sso: PRT SSO cookie can leak to attacker-controlled hosts when broad host permissions are grantedEPSS 0.2%CVE-2026-120309MEDIUMNuxt 4.6.0 before 4.6.2 Route Param Confusion via getRouterParamEPSS 0.2%CVE-2026-47076MEDIUMSSRF allowlist bypass via percent-encoded host in hackneyEPSS 0.2%CVE-2025-54368MEDIUMuv is vulnerable to ZIP payload obfuscation through parsing differentialsEPSS 0.2%