CWE-177 Improper Handling of URL Encoding (Hex Encoding)
variantThe product does not properly handle when all or part of an input has been URL encoded.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (22)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-76504US | critical9.8OT critical | KEV | ||
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system wit… | ||||
| CVE-2022-3782US | critical9.1 | Exploit | ||
keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to co… | ||||
| CVE-2026-29045US | critical9.8 | — | ||
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protectio… | ||||
| CVE-2026-22031US | high8.8 | — | ||
@fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 where middleware regist… | ||||
| CVE-2022-27780US | high7.5 | — | ||
The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it i… | ||||
| CVE-2023-47106US | medium6.5 | — | ||
Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment t… | ||||
| CVE-2022-3854US | medium6.5 | — | ||
A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of s… | ||||
| CVE-2015-1002US | medium6.4 | — | ||
IniNet embeddedWebServer (aka eWebServer) before 2.02 mishandles URL encoding, which allows remote attackers to write to or delete files via a crafted string. | ||||
| CVE-2024-48866US | medium5.3 | — | ||
An improper handling of URL encoding (Hex Encoding) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow re… | ||||
| CVE-2018-3718US | medium5.3 | — | ||
serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded. | ||||
| CVE-2025-11990US | low3.5 | — | ||
GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to gain CSRF tokens… | ||||
| CVE-2026-100409US | — | — | ||
OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and… | ||||
| CVE-2026-96748US | — | — | ||
PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostnam… | ||||
| CVE-2026-76172US | — | — | ||
fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme b… | ||||
| CVE-2026-67448US | — | — | ||
Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while… | ||||
| CVE-2026-15371US | — | — | ||
Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not li… | ||||
| CVE-2026-59083US | — | — | ||
Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.
This issue affects Apac… | ||||
| CVE-2026-41041US | — | — | ||
URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino.
This issue affects Apache Gravitino: from 1.0.0 before 1.2.1.
Users are recommended… | ||||
| CVE-2026-6414US | — | — | ||
@fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters. Th… | ||||
| CVE-2026-22037US | —OT elevated | — | ||
The @fastify/express plugin adds full Express compatibility to Fastify. A security vulnerability exists in @fastify/express prior to version 4.0.3 where middleware registered with… | ||||
03
attack patterns (4)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan