CWE-173 Improper Handling of Alternate Encoding
variantThe product does not properly handle when an input uses an alternate encoding that is valid for the control sphere to which the input is being sent.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (11)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-9636US | critical9.8OT elevated | — | ||
Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Informa… | ||||
| CVE-2026-10050US | critical9.1 | — | ||
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.
This was done because the initial specification for HTTP did n… | ||||
| CVE-2023-25742US | medium6.5 | — | ||
When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. This vulnerability affects Firefox < 110, Thunderbird < 102.8, a… | ||||
| CVE-2022-0235US | medium6.1 | — | ||
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor | ||||
| CVE-2023-26303US | medium5.5 | — | ||
Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially crafted input. | ||||
| CVE-2023-26302US | medium5.5 | — | ||
Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as input. | ||||
| CVE-2026-103276US | medium5.3 | — | ||
Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme templates and metadata. Attackers can use U… | ||||
| CVE-2024-54158US | medium5.3 | — | ||
In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding | ||||
| CVE-2020-8908US | low3.3 | — | ||
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created… | ||||
| CVE-2026-81638US | — | — | ||
Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifier.
AshDou… | ||||
| CVE-2026-19611US | — | — | ||
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote att… | ||||
03
attack patterns (12)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan