# CWE-172.

Every Advisory and CVE whose sources give the weakness CWE-172, newest first.

## Records, newest first

- [fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding](https://agentprime.io/advisories/GHSA-w74x-v6f9-j3xg.md)
  `GHSA-w74x-v6f9-j3xg`, `CVE-2026-110306` · npm `fast-uri`: affected `<2.4.8 || >=3.0.0, <3.1.9 || >=4.0.0, <4.2.3`, fixed in `2.4.8`, `3.1.9`, `4.2.3` · CVSS 6.1 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-172, CWE-180
- [NGINX ngx_http_v3_module vulnerability](https://agentprime.io/advisories/CVE-2026-95101.md)
  `CVE-2026-95101` · CVE record: F5 NGINX Plus and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-172
- [Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass](https://agentprime.io/advisories/GHSA-pc5q-qfxp-ggqv.md)
  `GHSA-pc5q-qfxp-ggqv`, `CVE-2026-104774`, `GO-2026-6696` · Go `github.com/corazawaf/coraza/v3`: affected `>=3.0.0, <3.8.0`, fixed in `3.8.0` · CVSS 5.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-172, CWE-193, CWE-693
- [RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers](https://agentprime.io/advisories/GHSA-7822-rcf6-97fx.md)
  `GHSA-7822-rcf6-97fx`, `CVE-2026-106122` · Maven `com.rabbitmq:amqp-client`: affected `<5.36.0`, fixed in `5.36.0` · CVSS 6.0 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-172, CWE-248
- [fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization](https://agentprime.io/advisories/GHSA-jvvf-x445-j334.md)
  `GHSA-jvvf-x445-j334`, `CVE-2026-86818` · npm `fast-uri`: affected `>=4.1.3, <4.1.5`, fixed in `4.1.5` · CVSS 4.8 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-172, CWE-436
- [Trusted Domain Project OpenDMARC Internationalized Domain Name opendmarc_policy.c opendmarc_policy_query_dmarc encoding error](https://agentprime.io/advisories/CVE-2026-100891.md)
  `CVE-2026-100891` · CVE record: Trusted Domain Project OpenDMARC · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: CWE-172
- [Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained \`../\` or \`./\` → Generated URL Collapses Off-Route Under RFC 3986 Normalization](https://agentprime.io/advisories/GHSA-h5x3-xfc9-m39h.md)
  `GHSA-h5x3-xfc9-m39h`, `CVE-2026-48784`, `PKSA-bf7t-jnpz-492k`, `PKSA-nshj-ydrr-y3c1` · Packagist `symfony/routing` and 1 more: affected `<5.4.53 || >=6.0.0, <6.4.41 || >=7.0.0, <7.4.13 || >=8.0.0, <8.0.13`, fixed in `5.4.53`, `6.4.41`, `7.4.13`, `8.0.13` · CVSS 5.1 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: Open redirect, CWE-172
- [NGINX ngx_http_proxy_v2_module vulnerability](https://agentprime.io/advisories/CVE-2026-42926.md)
  `CVE-2026-42926` · CVE record: F5 NGINX Open Source · CVSS 6.3 Medium · Not analysed yet · Published 13 May 2026 · Tags: CWE-172
- [Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements](https://agentprime.io/advisories/GHSA-vghf-hv5q-vc2g.md)
  `GHSA-vghf-hv5q-vc2g`, `CVE-2025-12758` · npm `validator`: affected `<13.15.22`, fixed in `13.15.22` · CVSS 8.7 High · Not analysed yet · Published 27 Nov 2025 · Tags: CWE-172, CWE-792
- [Libmodsecurity3 has possible bypass of encoded HTML entities](https://agentprime.io/advisories/CVE-2025-27110.md)
  `CVE-2025-27110` · CVE record: owasp-modsecurity ModSecurity · CVSS 7.9 High · Not analysed yet · Published 25 Feb 2025 · Tags: CWE-172
- [SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not in github.com/authzed/spicedb](https://agentprime.io/advisories/GHSA-3c32-4hq9-6wgj.md)
  `GHSA-3c32-4hq9-6wgj`, `CVE-2024-48909`, `GO-2024-3200` · Go `github.com/authzed/spicedb`: affected `>=1.35.0, <1.37.1`, fixed in `1.37.1` · CVSS 2.0 Low · Not analysed yet · Published 15 Oct 2024 · Tags: CWE-172
- [The kstring integration in gix-attributes is unsound](https://agentprime.io/advisories/GHSA-cx7h-h87r-jpgr.md)
  `GHSA-cx7h-h87r-jpgr`, `RUSTSEC-2024-0359` · crates.io `gix-attributes`: affected `<0.22.3`, fixed in `0.22.3` · No CVSS score · Not analysed yet · Published 25 Jul 2024 · Tags: CWE-172
- [Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19](https://agentprime.io/advisories/GHSA-c99r-67x4-whj6.md)
  `GHSA-c99r-67x4-whj6`, `CVE-2021-33604` · Maven `com.vaadin:vaadin-bom`: affected `>=14.0.0, <14.6.2 || >=15.0.0, <19.0.9`, fixed in `14.6.2`, `19.0.9` · CVSS 2.5 Low · Not analysed yet · Published 28 Jun 2021 · Tags: CWE-172
- [Reflected cross-site scripting in development mode handler in Vaadin](https://agentprime.io/advisories/GHSA-8vfw-v2jv-9hwc.md)
  `GHSA-8vfw-v2jv-9hwc` · Maven `com.vaadin:flow-server`: affected `>=2.0.0, <2.6.2 || >=3.0.0, <6.0.10`, fixed in `2.6.2`, `6.0.10` · CVSS 2.5 Low · Not analysed yet · Published 28 Jun 2021 · Tags: CWE-172
- [Cisco Adaptive Security Appliance Software SSL VPN Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2019-12677.md)
  `CVE-2019-12677` · CVE record: Cisco Cisco Adaptive Security Appliance (ASA) Software · CVSS 7.7 High · Not analysed yet · Published 2 Oct 2019 · Tags: CWE-172
- [ClusterLabs fence-agents: A flaw was discovered in fence-agents, prior to version 4.3.4…](https://agentprime.io/advisories/CVE-2019-10153.md)
  `CVE-2019-10153` · CVE record: ClusterLabs fence-agents · CVSS 5.0 Medium · Not analysed yet · Published 30 Jul 2019 · Tags: CWE-172
- [python: A security regression of CVE-2019-9636 was discovered in python since commit…](https://agentprime.io/advisories/CVE-2019-10160.md)
  `CVE-2019-10160` · CVE record: Python python · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jun 2019 · Tags: CWE-172
- [restforce vulnerable to Improper Input Validation](https://agentprime.io/advisories/GHSA-534w-937m-v7x3.md)
  `GHSA-534w-937m-v7x3`, `CVE-2018-3777` · RubyGems `restforce`: affected `<3.0.0`, fixed in `3.0.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Aug 2018 · Tags: CWE-20, CWE-172

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-172>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-172/>. Everything for agents: <https://agentprime.io/llms.txt>.