CWE-436.

@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)

• CWE-436

<4.0.5 · fixed in 4.0.5

@fastify/express's middleware path doubling causes authentication bypass in child plugin scopes

• CWE-436

<4.0.5 · fixed in 4.0.5

Multiple security fixes in justhtml

• Cross-site scripting (XSS)
• CWE-20

<1.16.0 · fixed in 1.16.0

Parse Server: File upload Content-Type override via extension mismatch

• CWE-436

<8.6.73 || >=9.0.0, <9.7.1-alpha.4 · fixed in 8.6.73, 9.7.1-alpha.4

OpenClaw: Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config

• CWE-372
• CWE-436

<2026.3.31 · fixed in 2026.3.31

Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing

• CWE-436

>=3.0.0.beta1, <3.1.21 || >=3.2.0, <3.2.6 · fixed in 3.1.21, 3.2.6

Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass.

• CWE-436

<2.2.23 || >=3.0.0.beta1, <3.1.21 || >=3.2.0, <3.2.6 · fixed in 2.2.23, 3.1.21, 3.2.6

Duplicate Advisory: OpenClaw: system.run approval identity mismatch could execute a different binary than displayed

• CWE-436

<=2026.2.24 · no fixed version yet

Duplicate Advisory: OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text

• Command injection
• CWE-436

<=2026.2.23 · no fixed version yet

Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

• CWE-436
• CWE-1395

<1.4.1 · fixed in 1.4.1

astral-tokio-tar insufficiently validates PAX extensions during extraction

• CWE-436

<0.6.0 · fixed in 0.6.0

OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv

• Broken access control
• CWE-436

<2026.3.11 · fixed in 2026.3.11

OpenClaw: system.run allow-always persistence included shell-commented payload tails

• Broken access control
• CWE-436

<2026.3.7 · fixed in 2026.3.7

OpenClaw: system.run wrapper-depth boundary could skip shell approval gating

• Broken access control
• CWE-436

<2026.3.7 · fixed in 2026.3.7

Header Email Address Parsing

• SEPPmail Secure Email Gateway
• CWE-436

OpenClaw has exec allowlist/safeBins policy-runtime mismatch via env -S wrapper interpretation

• CWE-436

<2026.2.23 · fixed in 2026.2.23

OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text

• Broken access control
• CWE-436

<2026.2.24 · fixed in 2026.2.24

OpenClaw: system.run approval identity mismatch could execute a different binary than displayed

• Broken access control
• CWE-436

<2026.2.25 · fixed in 2026.2.25

OpenClaw: Unicode canonicalization drift in node metadata policy classification could broaden node allowlists

• CWE-176
• CWE-436

<2026.3.1 · fixed in 2026.3.1

MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity

• CWE-178
• CWE-436

<1.3.1 · fixed in 1.3.1

Fickling: OBJ opcode call invisibility bypasses all safety checks

• CWE-436

<0.1.8 · fixed in 0.1.8

Interpretation Conflict in GitLab

• GitLab
• CWE-436

Fastify's Content-Type header tab character allows body validation bypass

• CWE-179
• CWE-436

<5.7.2 · fixed in 5.7.2

Path Normalization Bypass in Traefik Router + Middleware Rules

• CWE-436

<=1.7.34 · no fixed version yet

node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization

• CWE-436

<1.3.2 · fixed in 1.3.2

Duplicate Advisory: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict

• CWE-436
• CWE-1286

<7.0.7 · fixed in 7.0.7

Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict

• CWE-20
• CWE-436

<7.0.7 · fixed in 7.0.7

uv allows ZIP payload obfuscation through parsing differentials

• CWE-20
• CWE-436

<0.8.6 · fixed in 0.8.6

Git allows arbitrary code execution through broken config quoting

• git
• Path traversal
• CWE-436

Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)

• Weak cryptography or TLS
• CWE-436

<1.12.4 || >=1.13.0, <1.18.0 · fixed in 1.12.4, 1.18.0

Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)

• Weak cryptography or TLS
• CWE-436

<1.12.4 || >=1.13.0, <1.18.0 · fixed in 1.12.4, 1.18.0

Missing validation of header name and value in codeigniter4/framework

• CWE-436

<4.5.8 · fixed in 4.5.8

Git Credential Manager carriage-return character in remote URL allows malicious repository to leak credentials

• Information disclosure
• CWE-436

<2.6.1 · fixed in 2.6.1

Gateway API route matching order contradicts specification

• Other injection
• CWE-436

>=1.15.0, <1.15.8 || >=1.16.0, <1.16.1 · fixed in 1.15.8, 1.16.1

OpenStack Nova vulnerable to unauthorized access to potentially sensitive data

• Information disclosure
• CWE-436

<=27.4.0 || >=28.0.0, <=28.2.0 || >=29.0.0, <=29.1.0 · no fixed version yet

Name confusion in x509 Subject Alternative Name fields

• CWE-436

<1.0.22 || >=2.0.0, <2.0.46 || >=3.0.0, <3.0.33 · fixed in 1.0.22, 2.0.46, 3.0.33

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponen…

• CWE-436

Cisco Adaptive Security Appliance (ASA) Software: A vulnerability in the activation of an access control list (ACL) on Cisco Adaptive…

• Cisco Adaptive Security Appliance (ASA) Software
• Cisco Firepower Threat Defense Software
• CWE-436

btcd susceptible to consensus failures

• CWE-436

<0.24.0 · fixed in 0.24.0

Softing Secure Integration Server Interpretation Conflict Remote Code Execution Vulnerability

• Softing Secure Integration Server
• CWE-436

PAN-OS: Predefined Decryption Exclusions Does Not Work as Intended

• Palo Alto Networks PAN-OS
• Palo Alto Networks Cloud NGFW
• CWE-436

HCL BigFix Platform is susceptible to a Denial of Service attack

• HCL Software BigFix Platform
• CWE-436

Usage of disabled protocol

• curl
• CWE-436

CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained

• Cross-site scripting (XSS)
• CWE-436

<2.2.6 || >=3.0.0, <3.0.7 · fixed in 2.2.6, 3.0.7

Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some mail user agents) when there are multiple boundary parameters…

• CWE-436

Bref vulnerable to Body Parsing Inconsistency in Event-Driven Functions

• CWE-436

<2.1.13 · fixed in 2.1.13

Bref Doesn't Support Multiple Value Headers in ApiGatewayFormatV2

• CWE-436

<2.1.13 · fixed in 2.1.13

Command substitution output can trigger shell expansion in fish shell

• fish-shell
• CWE-436

Fortinet IPS Engine: A interpretation conflict in Fortinet IPS Engine versions 7.321…

• Fortinet IPS Engine
• CWE-436

Authentik lacks Proxy IP headers validation

• authentik
• CWE-436

There is a misinterpretation of input vulnerability in Huawei Printer.

• Huawei BiSheng-WNM
• CWE-436

Improper Input Validation in nyholm/psr7

• CWE-436

<1.6.1 · fixed in 1.6.1

Improper header validation in httpsoft/http-message

• CWE-436

<1.0.12 · fixed in 1.0.12

Improper header name validation in guzzlehttp/psr7

• CWE-436

<1.9.1 || >=2.0.0, <2.4.5 · fixed in 1.9.1, 2.4.5

Insecure header validation in slim/psr7

• CWE-436

<1.4.1 || >=1.5, <1.5.1 || >=1.6, <1.6.1 · fixed in 1.4.1, 1.5.1, 1.6.1

OpenZeppelin Contracts TransparentUpgradeableProxy clashing selector calls may not be delegated

• CWE-436

>=3.2.0, <4.8.3 · fixed in 4.8.3

In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an…

• CWE-436

There is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325.

• BiSheng-WNM
• CWE-436

There is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325.

• BiSheng-WNM
• CWE-436

User uploads proxied from S3 lack `Content-Security-Policy` headers, may be served with `Content-Disposition: inline` in zulip

• zulip
• CWE-436