Fallos del tipo CWE-436

115 resultados

Conflito de Interpretação

Ocorre quando diferentes componentes ou camadas da aplicação interpretam o mesmo dado de formas distintas, levando a decisões de segurança inconsistentes. Um validador pode considerar uma entrada segura enquanto um processador posterior a interpreta de modo diferente, abrindo brecha para bypass de controles.

Ejemplo

Um WAF valida a URL decodificando %2e%2e (..), mas o servidor web interpreta sequências de escape de forma distinta e permite traversal de diretório. Ou um filtro XSS bloqueia '<script>' mas a aplicação JavaScript interpreta a mesma string codificada como código executável.

Cómo mitigar

Normalize e valide dados uma única vez, no ponto mais próximo de entrada, usando a mesma codificação e regras que o processador final usará. Implemente testes que verifiquem que validador e processador concordam na interpretação, inclusive com variações de codificação (UTF-8, URL encoding, HTML entities).

CVE-2026-25223HIGHFastify's Content-Type header tab character allows body validation bypassEPSS 0.8%CVE-2023-36456HIGHAuthentik lacks Proxy IP headers validationEPSS 0.8%CVE-2023-30536MEDIUMInsecure header validation in slim/psr7EPSS 0.7%CVE-2025-12816HIGHCVE-2025-12816EPSS 0.7%CVE-2026-47767HIGHSymfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv MismatchEPSS 0.7%CVE-2024-38428CRITICALurl.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in whiEPSS 0.7%CVE-2022-0011MEDIUMPAN-OS: URL Category Exceptions Match More URLs Than Intended in URL FilteringEPSS 0.7%CVE-2022-29254LOWFailed payment recorded has completed in silverstripe/silverstripe-omnipayEPSS 0.7%CVE-2026-56669HIGHElysia: Inefficient Algorithmic Complexity and Interpretation ConflictEPSS 0.6%CVE-2024-24754LOWBref Body Parsing Inconsistency in Event-Driven FunctionsEPSS 0.6%CVE-2026-17084MEDIUMstringprep.map_table_b2() deviates from RFC 3454 Table B.2EPSS 0.6%CVE-2022-36048MEDIUMIP address leak via image proxy bypass in Zulip ServerEPSS 0.6%CVE-2024-34478HIGHbtcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failuEPSS 0.6%CVE-2026-8034HIGHServer-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusionEPSS 0.5%CVE-2026-14198CRITICAL@fastify/middie vulnerable to authorization bypass via encoded slash in path parameter valuesEPSS 0.5%CVE-2023-22735MEDIUMUser uploads proxied from S3 lack `Content-Security-Policy` headers, may be served with `Content-Disposition: inline` in zulipEPSS 0.5%CVE-2026-6322HIGHfast-uri vulnerable to host confusion via percent-encoded authority delimitersEPSS 0.5%CVE-2026-40165HIGHauthentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier TruncationEPSS 0.5%CVE-2026-6270CRITICAL@fastify/middie vulnerable to middleware authentication bypass in child plugin scopesEPSS 0.5%CVE-2025-24013MEDIUMCodeIgniter validation of header name and valueEPSS 0.5%