CWE-436.

ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)

• ModSecurity
• CWE-436

Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling

• Apache Software Foundation Apache Sling Engine
• HTTP request smuggling
• CWE-436

Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath

• kyverno
• CWE-436

CVE-2026-118517: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority: Incomplete Fix for CVE-2026-45066

• CWE-184
• CWE-436

>=6.1.0, <6.2.0 || >=6.2.0, <6.3.0 || >=6.3.0, <6.4.0 || >=6.4.0, <6.4.50 || >=7.0.0, <7.1.0 || >=7.1.0, <7.2.0 || >=7.2.0, <7.3.0 || >=7.3.0, <7.4.0 || >=7.4.0, <7.4.23 || >=8.0.0, <8.1.0 || >=8.1.0, <8.1.11 · fixed in 6.2.0, 6.3.0, 6.4.0, 6.4.50, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.23, 8.1.0, 8.1.11

CVE-2026-118517: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority: Incomplete Fix for CVE-2026-45066

• CWE-184
• CWE-436

>=6.1.0, <6.2.0 || >=6.2.0, <6.3.0 || >=6.3.0, <6.4.0 || >=6.4.0, <6.4.50 || >=7.0.0, <7.1.0 || >=7.1.0, <7.2.0 || >=7.2.0, <7.3.0 || >=7.3.0, <7.4.0 || >=7.4.0, <7.4.23 || >=8.0.0, <8.1.0 || >=8.1.0, <8.1.11 · fixed in 6.2.0, 6.3.0, 6.4.0, 6.4.50, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.23, 8.1.0, 8.1.11

CVE-2026-118516: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control

• Broken access control
• CWE-436

>=4.1.0, <4.2.0 || >=4.2.0, <4.3.0 || >=4.3.0, <4.4.0 || >=4.4.0, <5.0.0 || >=5.0.0, <5.1.0 || >=5.1.0, <5.2.0 || >=5.2.0, <5.3.0 || >=5.3.0, <5.4.0 || >=5.4.0, <5.4.56 || >=6.0.0, <6.1.0 || >=6.1.0, <6.2.0 || >=6.2.0, <6.3.0 || >=6.3.0, <6.4.0 || >=6.4.0, <6.4.50 || >=7.0.0, <7.1.0 || >=7.1.0, <7.2.0 || >=7.2.0, <7.3.0 || >=7.3.0, <7.4.0 || >=7.4.0, <7.4.23 || >=8.0.0, <8.1.0 || >=8.1.0, <8.1.11 · fixed in 4.2.0, 4.3.0, 4.4.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.4.56, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.50, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.23, 8.1.0, 8.1.11

CVE-2026-118516: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control

• Broken access control
• CWE-436

>=4.1.0, <4.2.0 || >=4.2.0, <4.3.0 || >=4.3.0, <4.4.0 || >=4.4.0, <5.0.0 || >=5.0.0, <5.1.0 || >=5.1.0, <5.2.0 || >=5.2.0, <5.3.0 || >=5.3.0, <5.4.0 || >=5.4.0, <5.4.56 || >=6.0.0, <6.1.0 || >=6.1.0, <6.2.0 || >=6.2.0, <6.3.0 || >=6.3.0, <6.4.0 || >=6.4.0, <6.4.50 || >=7.0.0, <7.1.0 || >=7.1.0, <7.2.0 || >=7.2.0, <7.3.0 || >=7.3.0, <7.4.0 || >=7.4.0, <7.4.23 || >=8.0.0, <8.1.0 || >=8.1.0, <8.1.11 · fixed in 4.2.0, 4.3.0, 4.4.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.4.56, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.50, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.23, 8.1.0, 8.1.11

CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs

• CWE-436

Google Chrome: Security issue in Platform in Google Chrome prior to 157.0.8103.38 allowed a remote…

• Google Chrome
• CWE-436

DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation

• Broken access control
• CWE-436

<0.22.6 · fixed in 0.22.6

@fastify/http-proxy vulnerable to prefix escape via decoded route parameters

• @fastify/http-proxy
• Path traversal
• CWE-436

Nuxt 4.6.0 before 4.6.2 Route Param Confusion via getRouterParam

• nuxt
• CWE-436

Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

• Weak cryptography or TLS
• CWE-436

<1.4.1 · fixed in 1.4.1

Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

• Broken access control
• CWE-41

>=4.6.0, <4.6.3 · fixed in 4.6.3

Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

• CWE-436

<1.0.8 · fixed in 1.0.8

zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

• CWE-20
• CWE-436

<9.0.5 · fixed in 9.0.5

MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment

• CWE-436

MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename

• CWE-436

MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguous

• CWE-436

MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations

• CWE-436

MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary

• CWE-436

Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped

• CWE-20
• CWE-436

>=3.0.0, <10.0.13 · fixed in 10.0.13

@fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets

• @fastify/express
• CWE-436

SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney

• Server-side request forgery (SSRF)
• CWE-436

>=4.0.1, <4.9.0 · fixed in 4.9.0

adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names

• cthackers adm-zip
• CWE-436

Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient

• CWE-20
• CWE-436

>=3.0.0, <10.1.4 · fixed in 10.1.4

Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient

• CWE-20
• CWE-436

>=3.0.0, <10.1.4 · fixed in 10.1.4

Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name

• CWE-20
• CWE-436

>=3.0.0, <10.1.4 · fixed in 10.1.4

fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

• CWE-20
• CWE-436

>=2.4.2, <2.4.8 || >=3.1.3, <3.1.9 || >=4.0.1, <4.2.3 · fixed in 2.4.8, 3.1.9, 4.2.3

Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

• Broken access control
• CWE-436

>=3.11.0, <3.21.4 || >=4.0.0, <4.4.4 · fixed in 3.21.4, 4.4.4

Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher

• traefik
• CWE-436

Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path Segments

• Apache Software Foundation Apache bRPC
• CWE-436

Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators

• vyper
• CWE-436

@fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch

• @fastify/middie
• CWE-436

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse

• CWE-436

kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

• CWE-289
• CWE-436

>=0.144.0, <0.147.0 · fixed in 0.147.0

NGINX ngx_http_js_module vulnerability

• F5 NGINX JavaScript
• CWE-436

Roo-Code through 3.54.0 Auto-Approve Bypass via Command Substitution at Command Position

• RooCodeInc Roo-Code
• CWE-436

Roo-Code through 3.54.0 Auto-Approve Bypass via Funsub Command Substitution

• RooCodeInc Roo-Code
• CWE-436

Roo-Code through 3.54.0 Auto-Approve Bypass via Quote Masking Desynchronization

• RooCodeInc Roo-Code
• CWE-436

Roo-Code through 3.54.0 Auto-Approve Bypass via Redirect Operator Stripping

• RooCodeInc Roo-Code
• CWE-436

Mistral Vibe < 2.25.4 Bash Permission Bypass via ${var@P} Prompt-Transform

• mistralai mistral-vibe
• CWE-436

Mistral Vibe < 2.25.5 Permission Bypass via Bash Line Continuation

• mistralai mistral-vibe
• CWE-436

Network-AI 5.14.0 before 5.15.2 Deny Pattern Bypass via ClaudeHookBridge extractFullTarget

• Jovancoding Network-AI
• CWE-436

Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules

• open-webui
• Denial of service
• CWE-436

Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver

• MongoDB C++ Driver
• CWE-436

Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection

• CWE-20
• CWE-436

>=3.0.4, <3.8.1 · fixed in 3.8.1

Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules

• CWE-20
• CWE-436

<3.8.1 · fixed in 3.8.1

Coraza has Cookie Parser Confusion

• CWE-436

<3.8.1 · fixed in 3.8.1

Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

• CWE-20
• CWE-436

>=3.0.0, <3.8.0 · fixed in 3.8.0

Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection

• CWE-20
• CWE-436

>=3.0.0, <3.8.1 · fixed in 3.8.1

Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend

• CWE-426
• CWE-436

<1.15.4 · fixed in 1.15.4

@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

• Authentication bypass
• CWE-436

<11.2.4 || >=12.0.0, <12.0.2 · fixed in 11.2.4, 12.0.2

fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

• CWE-172
• CWE-436

>=4.1.3, <4.1.5 · fixed in 4.1.5

Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

• CWE-20
• CWE-436

>=9.1.0, <10.0.9 · fixed in 10.0.9

adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

• CWE-436
• CWE-696

<0.6.1 · fixed in 0.6.1

fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

• CWE-436

>=2.4.5, <2.4.6 || >=3.1.6, <3.1.7 || >=4.1.3, <4.1.4 · fixed in 2.4.6, 3.1.7, 4.1.4

elysia has Inefficient Algorithmic Complexity and Interpretation Conflict

• Denial of service
• CWE-436

<1.4.29 · fixed in 1.4.29

Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)

• envoy
• CWE-289
• CWE-436

Envoy: RBAC Authorization Bypass via Path Parameters

• envoy
• CWE-436