CWE-176.

SD JWT JS: Tampered disclosures silently dropped instead of rejected

• CWE-176
• CWE-754

<0.20.0 · fixed in 0.20.0

Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding

• netty-tcnative
• netty-tcnative-boringssl-static
• CWE-176

Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters

• vyper
• CWE-176

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp

• CWE-176

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv

• Memory corruption
• CWE-176

MOVEit Transfer Email MFA Bypass

• Progress MOVEit Transfer
• CWE-176

Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch

• Apache Software Foundation Apache log4net
• CWE-176

Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names

• CWE-176

Fireware OS Improper Authorization in Access Portal Reverse Proxy

• WatchGuard Fireware OS
• Path traversal
• Broken access control

OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation

• Denial of service
• CWE-176

>=1.10.0, <1.33.0 · fixed in 1.33.0

Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate

• libexpat
• CWE-176

uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecChars

• garycourt uri-js
• CWE-176

Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions

• HashiCorp go-slug
• CWE-176

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

• CWE-176
• CWE-697

<83.0.0 · fixed in 83.0.0

ln: rejects non-UTF-8 source filenames in target-directory mode

• CWE-176

<0.6.0 · fixed in 0.6.0

comm: lossy UTF-8 conversion silently corrupts non-UTF-8 output

• CWE-116
• CWE-176

<0.6.0 · fixed in 0.6.0

node: A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling…

• node
• CWE-176
• CWE-289

Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)

• CWE-41
• CWE-176

<2.7.14 · fixed in 2.7.14

SQLite sqldiff remote code execution via argument injection

• SQLite sqldiff
• CWE-176

Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files

• CWE-20
• CWE-176

>=2.7.0, <2.11.3 · fixed in 2.11.3

FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

• CWE-20
• CWE-176

>=1.11.2, <1.12.3 · fixed in 1.12.3

protobufjs has overlong UTF-8 decoding

• CWE-176

<7.5.6 || >=8.0.0, <8.0.2 · fixed in 7.5.6, 8.0.2

Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have heap overflow when processing some malformed UTF-8 characters

• RRWO Text::Minify::XS
• Memory corruption
• CWE-176

Duplicate Advisory: uutils coreutils has an Improper Handling of Unicode Encoding Issue

• CWE-176

<=0.8.0 · no fixed version yet

uutils coreutils has an Improper Handling of Unicode Encoding Issue

• CWE-176

<0.8.0 · fixed in 0.8.0

Duplicate Advisory: coreutils' comm utility silently corrupts data by performing lossy UTF-8 conversion on all output lines

• CWE-176

<0.6.0 · fixed in 0.6.0

Improper Input Validation during User Account Creation in Splunk Enterprise

• Splunk Enterprise
• Splunk Cloud Platform
• CWE-176

SonicWall SMA1000: Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a…

• SonicWall SMA1000
• CWE-176

SonicWall SMA1000: Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a…

• SonicWall SMA1000
• CWE-176

XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes

• TODDR XML::Parser
• Memory corruption
• CWE-176

OpenClaw: Unicode canonicalization drift in node metadata policy classification could broaden node allowlists

• CWE-176
• CWE-436

<2026.3.1 · fixed in 2026.3.1

Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)

• CWE-20
• CWE-176

>=2.19.0, <2.20.0 · fixed in 2.20.0

Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS

• Cross-site request forgery (CSRF)
• Race condition

<7.5.4 · fixed in 7.5.4

Revive Adserver: HackerOne community member Kassem S.(kassem_s94) has reported that username handling in…

• Revive Adserver
• CWE-176

DNN's CKEditor File Uploader functionality vulnerable through Unicode obfuscation

• dnnsoftware Dnn.Platform
• CWE-176

In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization.

• Google Android
• CWE-176

XZ Utils on Microsoft Windows platform are vulnerable to argument injection

• tukaani-project xz
• Command injection
• CWE-176

Unicode "best fit" argument injection

• Helix Core
• CWE-176

Some Microsoft technologies as used in Windows 8 through 11 allow a temporary client-side performance degradation during processing of multiple Unicode combining characters, aka a "Zalgo text" attack.

• CWE-176

Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input Validation

• Zoom Video Communications, Inc. Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows
• CWE-176

ewen-lbh/ffcss Late-Unicode normalization vulnerability

• Other injection
• CWE-176

<0.2.0 · fixed in 0.2.0

Late-Unicode normalization vulnerability in SHIRASAGI

• shirasagi
• CWE-176

Improper Handling of Unicode Encoding

• Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software
• CWE-176

Zoom Video Communications…: Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom…

• Zoom Video Communications, Inc. Zoom Desktop Client for Windows and Zoom VDI Client
• CWE-176

JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode…

• JetBrains IntelliJ IDEA
• CWE-176

Ciphertext Malleability Issue in Tink Java

• Weak cryptography or TLS
• CWE-176

<1.5.0 · fixed in 1.5.0