Falhas do tipo CWE-436

115 resultados

Conflito de Interpretação

Ocorre quando diferentes componentes de um sistema interpretam a mesma entrada, comando ou formato de dados de formas distintas, criando uma desconexão entre a intenção e o resultado. Um atacante explora essa divergência para contornar validações, executar ações não autorizadas ou injetar código malicioso.

Exemplo

Um firewall bloqueia requisições HTTP com 'union select' na query, mas o servidor backend interpreta sequências de espaços e comentários SQL de forma diferente do WAF. O atacante envia 'uni/**/on sel/**/ ect' que passa pelo filtro, mas o banco de dados executa como SQL injection completo.

Como mitigar

Normalize todas as entradas em um único ponto, antes de qualquer processamento, garantindo que validadores (WAF, parsers, bancos de dados) usem as mesmas regras. Implemente testes de integração que verifiquem se diferentes camadas interpretam dados idênticos da mesma maneira.

CVE-2026-25223HIGHFastify's Content-Type header tab character allows body validation bypassEPSS 0.8%CVE-2023-36456HIGHAuthentik lacks Proxy IP headers validationEPSS 0.8%CVE-2023-30536MEDIUMInsecure header validation in slim/psr7EPSS 0.7%CVE-2025-12816HIGHCVE-2025-12816EPSS 0.7%CVE-2026-47767HIGHSymfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv MismatchEPSS 0.7%CVE-2024-38428CRITICALurl.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in whiEPSS 0.7%CVE-2022-0011MEDIUMPAN-OS: URL Category Exceptions Match More URLs Than Intended in URL FilteringEPSS 0.7%CVE-2022-29254LOWFailed payment recorded has completed in silverstripe/silverstripe-omnipayEPSS 0.7%CVE-2026-56669HIGHElysia: Inefficient Algorithmic Complexity and Interpretation ConflictEPSS 0.6%CVE-2024-24754LOWBref Body Parsing Inconsistency in Event-Driven FunctionsEPSS 0.6%CVE-2026-17084MEDIUMstringprep.map_table_b2() deviates from RFC 3454 Table B.2EPSS 0.6%CVE-2022-36048MEDIUMIP address leak via image proxy bypass in Zulip ServerEPSS 0.6%CVE-2024-34478HIGHbtcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failuEPSS 0.6%CVE-2026-8034HIGHServer-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusionEPSS 0.5%CVE-2026-14198CRITICAL@fastify/middie vulnerable to authorization bypass via encoded slash in path parameter valuesEPSS 0.5%CVE-2023-22735MEDIUMUser uploads proxied from S3 lack `Content-Security-Policy` headers, may be served with `Content-Disposition: inline` in zulipEPSS 0.5%CVE-2026-6322HIGHfast-uri vulnerable to host confusion via percent-encoded authority delimitersEPSS 0.5%CVE-2026-40165HIGHauthentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier TruncationEPSS 0.5%CVE-2026-6270CRITICAL@fastify/middie vulnerable to middleware authentication bypass in child plugin scopesEPSS 0.5%CVE-2025-24013MEDIUMCodeIgniter validation of header name and valueEPSS 0.5%