Falhas do tipo CWE-436

115 resultados

Conflito de Interpretação

Ocorre quando diferentes componentes de um sistema interpretam a mesma entrada, comando ou formato de dados de formas distintas, criando uma desconexão entre a intenção e o resultado. Um atacante explora essa divergência para contornar validações, executar ações não autorizadas ou injetar código malicioso.

Exemplo

Um firewall bloqueia requisições HTTP com 'union select' na query, mas o servidor backend interpreta sequências de espaços e comentários SQL de forma diferente do WAF. O atacante envia 'uni/**/on sel/**/ ect' que passa pelo filtro, mas o banco de dados executa como SQL injection completo.

Como mitigar

Normalize todas as entradas em um único ponto, antes de qualquer processamento, garantindo que validadores (WAF, parsers, bancos de dados) usem as mesmas regras. Implemente testes de integração que verifiquem se diferentes camadas interpretam dados idênticos da mesma maneira.

CVE-2026-33808CRITICAL@fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)EPSS 0.5%CVE-2026-13676HIGHfast-uri vulnerable to host confusion via failed IDN canonicalizationEPSS 0.5%CVE-2023-49284LOWCommand substitution output can trigger shell expansion in fish shellEPSS 0.5%CVE-2026-44974HIGHParameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parametersEPSS 0.5%CVE-2022-48230HIGHThere is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation could lead to DoS.EPSS 0.5%CVE-2022-48261HIGHThere is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation of this vulnerability may cause theEPSS 0.5%CVE-2026-73615HIGHNetwork-AI SandboxPolicy before 5.15.1 Blocklist Bypass via Quote MismatchEPSS 0.5%CVE-2026-73614HIGHNetwork-AI ClaudeHookBridge Deny Pattern Bypass via TruncationEPSS 0.4%CVE-2022-48471HIGHThere is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer sEPSS 0.4%CVE-2026-57580CRITICALauthentik: Account Takeover via SAML NameID Comment TruncationEPSS 0.4%CVE-2024-29034MEDIUMCarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remainedEPSS 0.4%CVE-2024-3386MEDIUMPAN-OS: Predefined Decryption Exclusions Does Not Work as IntendedEPSS 0.4%CVE-2026-18427HIGH@fastify/static vulnerable to route guard bypass via non-canonical path segmentsEPSS 0.4%CVE-2026-33807CRITICAL@fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopesEPSS 0.4%CVE-2024-24753MEDIUMBref Multiple Value Headers Not Supported in ApiGatewayFormatV2EPSS 0.4%CVE-2023-40718MEDIUMA interpretation conflict in Fortinet IPS Engine versions 7.321, 7.166 and 6.158 allows attacker to evade IPS features via crafted TCP packeEPSS 0.4%CVE-2026-68968HIGHApache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill idEPSS 0.4%CVE-2026-0958HIGHInterpretation Conflict in GitLabEPSS 0.4%CVE-2023-45715LOWHCL BigFix Platform is susceptible to a Denial of Service attackEPSS 0.4%CVE-2026-42272HIGHHeimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretationEPSS 0.4%