Fallos del tipo CWE-176

43 resultados

Manipulação inadequada de codificação Unicode na entrada

A aplicação não processa corretamente caracteres Unicode, deixando passar validações ou causando interpretações diferentes do mesmo dado em camadas distintas (frontend vs backend, ou entre bibliotecas). Um atacante usa variações de codificação (UTF-8, UTF-16, normalizações) para contornar filtros de segurança ou injetar payloads maliciosos que parecem inofensivos em uma camada mas executam em outra.

Ejemplo

Um WAF bloqueia a string '<script>' mas um atacante envia '<script>' codificado em UTF-16 ou com caracteres compostos (combinando U+0073 + U+0063 + modificadores). Se a validação não decodifica Unicode antes de verificar, o payload passa; ao ser processado pelo navegador, a decodificação ocorre e o script executa.

Cómo mitigar

Sempre normalize Unicode (decomposição NFD ou NFC) e decodifique antes de qualquer validação ou filtro de segurança. Faça validação *após* normalização, não antes. Use listas brancas rigorosas para caracteres aceitáveis e considere rejeitar entrada fora do ASCII se o contexto permitir.

CVE-2026-110687HIGHCpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmpEPSS 0.4%CVE-2026-59890MEDIUMsetuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+EPSS 0.4%CVE-2026-93990HIGHExpat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked SurrogateEPSS 0.4%CVE-2026-93751MEDIUMuri-js through 4.4.1 Improper UTF-8 Decoding via pctDecCharsEPSS 0.4%CVE-2026-86105MEDIUMFireware OS Improper Authorization in Access Portal Reverse ProxyEPSS 0.3%CVE-2026-44288MEDIUMprotobufjs: Overlong UTF-8 decodingEPSS 0.3%CVE-2025-55129MEDIUMHackerOne community member Kassem S.(kassem_s94) has reported that username handling in Revive Adserver was still vulnerable to impersonatioEPSS 0.3%CVE-2026-23950HIGHnode-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFSEPSS 0.3%CVE-2017-20190—Some Microsoft technologies as used in Windows 8 through 11 allow a temporary client-side performance degradation during processing of multiEPSS 0.3%CVE-2025-59547MEDIUMDNN's CKEditor File Uploader functionality vulnerable through Unicode obfuscationEPSS 0.3%CVE-2026-114114MEDIUMVyper through 0.5.0b1 Literal Value Substitution via Multi-byte CharactersEPSS 0.3%CVE-2026-20202MEDIUMImproper Input Validation during User Account Creation in Splunk EnterpriseEPSS 0.2%CVE-2026-19954MEDIUMNet::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain namesEPSS 0.2%CVE-2026-62374HIGHSD JWT JS: Tampered disclosures silently dropped instead of rejectedEPSS 0.2%CVE-2026-116542MEDIUMNetty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 DecodingEPSS 0.2%CVE-2024-8067MEDIUMUnicode "best fit" argument injectionEPSS 0.2%CVE-2026-49401HIGHDeno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)EPSS 0.2%CVE-2022-29812LOWIn JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode directionality formatting characters were insufficientEPSS 0.2%CVE-2026-81869MEDIUMOpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncationEPSS 0.2%CVE-2026-35346LOWuutils coreutils comm Silent Data Corruption via Lossy UTF-8 NormalizationEPSS 0.2%