CWE-172.

fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

• CWE-172
• CWE-180

<2.4.8 || >=3.0.0, <3.1.9 || >=4.0.0, <4.2.3 · fixed in 2.4.8, 3.1.9, 4.2.3

NGINX ngx_http_v3_module vulnerability

• F5 NGINX Plus
• F5 NGINX Open Source
• CWE-172

Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass

• CWE-172
• CWE-193

>=3.0.0, <3.8.0 · fixed in 3.8.0

RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers

• CWE-172
• CWE-248

<5.36.0 · fixed in 5.36.0

fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

• CWE-172
• CWE-436

>=4.1.3, <4.1.5 · fixed in 4.1.5

Trusted Domain Project OpenDMARC Internationalized Domain Name opendmarc_policy.c opendmarc_policy_query_dmarc encoding error

• Trusted Domain Project OpenDMARC
• CWE-172

Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

• Open redirect
• CWE-172

<5.4.53 || >=6.0.0, <6.4.41 || >=7.0.0, <7.4.13 || >=8.0.0, <8.0.13 · fixed in 5.4.53, 6.4.41, 7.4.13, 8.0.13

NGINX ngx_http_proxy_v2_module vulnerability

• F5 NGINX Open Source
• CWE-172

Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements

• CWE-172
• CWE-792

<13.15.22 · fixed in 13.15.22

Libmodsecurity3 has possible bypass of encoded HTML entities

• ModSecurity
• CWE-172

SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not in github.com/authzed/spicedb

• CWE-172

>=1.35.0, <1.37.1 · fixed in 1.37.1

The kstring integration in gix-attributes is unsound

• CWE-172

<0.22.3 · fixed in 0.22.3

Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19

• CWE-172

>=14.0.0, <14.6.2 || >=15.0.0, <19.0.9 · fixed in 14.6.2, 19.0.9

Reflected cross-site scripting in development mode handler in Vaadin

• CWE-172

>=2.0.0, <2.6.2 || >=3.0.0, <6.0.10 · fixed in 2.6.2, 6.0.10

Cisco Adaptive Security Appliance Software SSL VPN Denial of Service Vulnerability

• Cisco Adaptive Security Appliance (ASA) Software
• CWE-172

ClusterLabs fence-agents: A flaw was discovered in fence-agents, prior to version 4.3.4…

• ClusterLabs fence-agents
• CWE-172

python: A security regression of CVE-2019-9636 was discovered in python since commit…

• python
• CWE-172

restforce vulnerable to Improper Input Validation

• CWE-20
• CWE-172

<3.0.0 · fixed in 3.0.0