Fallos del tipo CWE-436

159 resultados

Conflito de Interpretação

Ocorre quando diferentes componentes ou camadas da aplicação interpretam o mesmo dado de formas distintas, levando a decisões de segurança inconsistentes. Um validador pode considerar uma entrada segura enquanto um processador posterior a interpreta de modo diferente, abrindo brecha para bypass de controles.

Ejemplo

Um WAF valida a URL decodificando %2e%2e (..), mas o servidor web interpreta sequências de escape de forma distinta e permite traversal de diretório. Ou um filtro XSS bloqueia '<script>' mas a aplicação JavaScript interpreta a mesma string codificada como código executável.

Cómo mitigar

Normalize e valide dados uma única vez, no ponto mais próximo de entrada, usando a mesma codificação e regras que o processador final usará. Implemente testes que verifiquem que validador e processador concordam na interpretação, inclusive com variações de codificação (UTF-8, URL encoding, HTML entities).

CVE-2026-103866—Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smugglingEPSS 0.2%CVE-2026-101019HIGHNGINX ngx_http_js_module vulnerabilityEPSS 0.2%CVE-2026-116266MEDIUMMIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguousEPSS 0.2%CVE-2026-116264MEDIUMMIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundaryEPSS 0.2%CVE-2026-116272MEDIUMMIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested commentEPSS 0.2%CVE-2026-116265MEDIUMMIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuationsEPSS 0.2%CVE-2026-116269MEDIUMMIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filenameEPSS 0.2%CVE-2026-40930MEDIUMLIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk bodyEPSS 0.2%CVE-2026-120635—CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCsEPSS 0.2%CVE-2026-73846MEDIUMCKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoningEPSS 0.2%CVE-2026-32762MEDIUMRack: Forwarded Header semicolon injection enables Host and Scheme spoofingEPSS 0.2%CVE-2026-106430MEDIUMQuery and rename target confusion via embedded NUL truncation in MongoDB C++ DriverEPSS 0.2%CVE-2026-42462HIGHFedify has an LD-Signature Bypass via JSON-LD Named-Graph RestructuringEPSS 0.2%CVE-2026-35200LOWParse Server has a file upload Content-Type override via extension mismatchEPSS 0.2%CVE-2026-91835LOWOpenClaw ClawScan File Classifier static_scanner.go IsBinaryFile interpretation conflictEPSS 0.2%CVE-2026-53655MEDIUMnode-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)EPSS 0.2%CVE-2026-114656MEDIUMTraefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host MatcherEPSS 0.2%CVE-2026-115700MEDIUMSSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackneyEPSS 0.1%CVE-2026-109331HIGHNetwork-AI 5.14.0 before 5.15.2 Deny Pattern Bypass via ClaudeHookBridge extractFullTargetEPSS 0.1%