Falhas do tipo CWE-176

43 resultados

Tratamento inadequado de codificação Unicode

A aplicação não valida ou processa corretamente caracteres Unicode, permitindo que representações alternativas do mesmo caractere (como bytes sobrenumerados, normalizações diferentes ou sequências de escape) passem por filtros de segurança. Isso pode contornar regras de validação, injetar payloads maliciosos ou causar comportamento inesperado na lógica da aplicação.

Exemplo

Um WAF bloqueia a string literal '<script>' em POST requests, mas um atacante envia '<script>' codificado como Unicode (ex: \u003cscript\u003e ou UTF-8 alternativo) e consegue executar JavaScript porque o filtro não normaliza a entrada antes de validar. Ou um sistema que verifica extensões de arquivo rejeita '.exe', mas aceita '파일.exe' (nome em Hangul + extensão) por não tratar nomes Unicode uniformemente.

Como mitigar

Normalize todas as entradas Unicode para uma forma canônica (NFC ou NFKC) antes de validação ou processamento, e implemente listas de caracteres permitidos (whitelist) em vez de bloqueios (blacklist). Valide após decodificação completa, não antes.

CVE-2026-110687HIGHCpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmpEPSS 0.4%CVE-2026-59890MEDIUMsetuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+EPSS 0.4%CVE-2026-93990HIGHExpat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked SurrogateEPSS 0.4%CVE-2026-93751MEDIUMuri-js through 4.4.1 Improper UTF-8 Decoding via pctDecCharsEPSS 0.4%CVE-2026-86105MEDIUMFireware OS Improper Authorization in Access Portal Reverse ProxyEPSS 0.3%CVE-2026-44288MEDIUMprotobufjs: Overlong UTF-8 decodingEPSS 0.3%CVE-2025-55129MEDIUMHackerOne community member Kassem S.(kassem_s94) has reported that username handling in Revive Adserver was still vulnerable to impersonatioEPSS 0.3%CVE-2026-23950HIGHnode-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFSEPSS 0.3%CVE-2017-20190—Some Microsoft technologies as used in Windows 8 through 11 allow a temporary client-side performance degradation during processing of multiEPSS 0.3%CVE-2025-59547MEDIUMDNN's CKEditor File Uploader functionality vulnerable through Unicode obfuscationEPSS 0.3%CVE-2026-114114MEDIUMVyper through 0.5.0b1 Literal Value Substitution via Multi-byte CharactersEPSS 0.3%CVE-2026-20202MEDIUMImproper Input Validation during User Account Creation in Splunk EnterpriseEPSS 0.2%CVE-2026-19954MEDIUMNet::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain namesEPSS 0.2%CVE-2026-62374HIGHSD JWT JS: Tampered disclosures silently dropped instead of rejectedEPSS 0.2%CVE-2026-116542MEDIUMNetty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 DecodingEPSS 0.2%CVE-2024-8067MEDIUMUnicode "best fit" argument injectionEPSS 0.2%CVE-2026-49401HIGHDeno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)EPSS 0.2%CVE-2022-29812LOWIn JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode directionality formatting characters were insufficientEPSS 0.2%CVE-2026-81869MEDIUMOpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncationEPSS 0.2%CVE-2026-35346LOWuutils coreutils comm Silent Data Corruption via Lossy UTF-8 NormalizationEPSS 0.2%