Falhas do tipo CWE-176

30 resultados

Tratamento inadequado de codificação Unicode

A aplicação não valida ou processa corretamente caracteres Unicode, permitindo que representações alternativas do mesmo caractere (como bytes sobrenumerados, normalizações diferentes ou sequências de escape) passem por filtros de segurança. Isso pode contornar regras de validação, injetar payloads maliciosos ou causar comportamento inesperado na lógica da aplicação.

Exemplo

Um WAF bloqueia a string literal '<script>' em POST requests, mas um atacante envia '<script>' codificado como Unicode (ex: \u003cscript\u003e ou UTF-8 alternativo) e consegue executar JavaScript porque o filtro não normaliza a entrada antes de validar. Ou um sistema que verifica extensões de arquivo rejeita '.exe', mas aceita '파일.exe' (nome em Hangul + extensão) por não tratar nomes Unicode uniformemente.

Como mitigar

Normalize todas as entradas Unicode para uma forma canônica (NFC ou NFKC) antes de validação ou processamento, e implemente listas de caracteres permitidos (whitelist) em vez de bloqueios (blacklist). Valide após decodificação completa, não antes.

CVE-2026-48618HIGHA flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypasEPSS 3.2%CVE-2024-24691CRITICALZoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input ValidationEPSS 1.7%CVE-2023-39213CRITICALImproper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before 5.15.2 may allow an unauthenticateEPSS 1.3%CVE-2024-47611MEDIUMXZ Utils on Microsoft Windows platform are vulnerable to argument injectionEPSS 0.8%CVE-2024-43093HIGHIn shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitEPSS 0.7%KEVCVE-2006-10002CRITICALXML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashesEPSS 0.6%CVE-2026-4114MEDIUMImproper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN admin to bypass AMC TOTP aEPSS 0.6%CVE-2023-41889MEDIUMLate-Unicode normalization vulnerability in SHIRASAGIEPSS 0.6%CVE-2026-45062HIGHFrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP FilesEPSS 0.6%CVE-2023-52081MEDIUMewen-lbh/ffcss late-Unicode normalization vulnerabilityEPSS 0.5%CVE-2026-45135HIGHCaddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP FilesEPSS 0.5%CVE-2020-8929MEDIUMCiphertext integrity weakness in TinkEPSS 0.5%CVE-2026-7040HIGHText::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have heap overflow when processing some malformed UTF-8 charactersEPSS 0.4%CVE-2026-4116HIGHImproper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/CEPSS 0.4%CVE-2026-25480MEDIUMFileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)EPSS 0.4%CVE-2026-59890MEDIUMsetuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+EPSS 0.4%CVE-2025-71316CRITICALSQLite sqldiff remote code execution via argument injectionEPSS 0.4%CVE-2023-31169MEDIUMImproper Handling of Unicode EncodingEPSS 0.4%CVE-2026-44288MEDIUMprotobufjs: Overlong UTF-8 decodingEPSS 0.3%CVE-2017-20190—Some Microsoft technologies as used in Windows 8 through 11 allow a temporary client-side performance degradation during processing of multiEPSS 0.3%