CWE-436.

http-cache-semantics through 4.2.0 Cross-Client Cache Disclosure via Vary Wildcard

• kornelski http-cache-semantics
• CWE-436

LMDeploy has an SSRF bypass

• Server-side request forgery (SSRF)
• CWE-436

>=0.12.3, <0.15.0 · fixed in 0.15.0

OpenClaw ClawScan File Classifier static_scanner.go IsBinaryFile interpretation conflict

• OpenClaw ClawScan
• CWE-436

Traefik entrypoint header-name sanitization bypassed via request trailers

• CWE-436
• CWE-807

>=3.2.0, <3.7.13 · fixed in 3.7.13

Google Chrome: Interpretation conflict in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36…

• Google Chrome
• CWE-436

Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain

• CWE-20
• CWE-436

<9.1.0 · fixed in 9.1.0

Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain

• CWE-20
• CWE-436

>=6.9.16, <9.1.0 · fixed in 9.1.0

Roo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch

• RooCodeInc Roo-Code
• CWE-436

Visual Studio Code Security Feature Bypass Vulnerability

• Microsoft Visual Studio Code
• CWE-436

@fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target

• @fastify/middie
• CWE-436

CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning

• CWE-345
• CWE-436

<0.4.112 · fixed in 0.4.112

Mail: Email address spoofing via malformed RFC 2047 encoded-words

• CWE-436

<2.9.1 · fixed in 2.9.1

fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references

• CWE-436

>=2.4.2, <2.4.5 || >=3.1.3, <3.1.6 || >=4.0.1, <4.1.3 · fixed in 2.4.5, 3.1.6, 4.1.3

authentik: Account Takeover via SAML NameID Comment Truncation

• authentik
• CWE-436

stringprep.map_table_b2() deviates from RFC 3454 Table B.2

• Python Software Foundation CPython
• CWE-436

Network-AI SandboxPolicy before 5.15.1 Blocklist Bypass via Quote Mismatch

• Jovancoding Network-AI
• CWE-436

Network-AI ClaudeHookBridge Deny Pattern Bypass via Truncation

• Jovancoding Network-AI
• CWE-436

IBM i is Affected By security restrictions bypass in Navigator for i

• i
• CWE-436

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authorization dependency parsed it with `int(...

• CWE-436

<3.3.1 · fixed in 3.3.1

@fastify/static vulnerable to route guard bypass via non-canonical path segments

• @fastify/static
• Path traversal
• CWE-436

Guzzle: Noncanonical host can bypass host-based checks

• Server-side request forgery (SSRF)
• CWE-180

<7.15.2 || >=8.0.0, <8.0.1 · fixed in 7.15.2, 8.0.1

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

• CWE-436
• CWE-524

>=7.0.0, <7.29.0 || >=8.0.0, <8.9.0 · fixed in 7.29.0, 8.9.0

fast-uri vulnerable to host confusion via backslash authority introducer

• CWE-436

<2.4.4 || >=3.0.0, <3.1.5 || >=4.0.0, <4.1.2 · fixed in 2.4.4, 3.1.5, 4.1.2

V 0.5.2 SSRF Bypass via Parser Differential in net.urllib and net.http

• v
• CWE-436

Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams

• Red Hat OpenShift Container Platform 4.12
• Red Hat OpenShift Container Platform 4.13
• CWE-436

fast-uri vulnerable to host confusion via literal backslash authority delimiter

• CWE-436

>=2.3.1, <2.4.3 || >=3.0.0, <3.1.4 || >=4.0.0, <4.1.1 · fixed in 2.4.3, 3.1.4, 4.1.1

fast-uri vulnerable to host confusion via failed IDN canonicalization

• CWE-436
• CWE-551

>=2.3.1, <2.4.2 || >=3.0.0, <3.1.3 || >=4.0.0, <4.0.1 · fixed in 2.4.2, 3.1.3, 4.0.1

guzzlehttp/psr7: Host Confusion via Weak URI Host Validation

• CWE-20
• CWE-436

<2.12.3 · fixed in 2.12.3

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

• WordPress
• CWE-436

Capgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore Decoding

• Capgo
• CWE-436

netfoil has a domain name filter bypass via multiple questions

• CWE-436
• CWE-693

<0.3.0 · fixed in 0.3.0

@fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values

• @fastify/middie
• CWE-436

@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

• Broken access control
• CWE-436

<0.3.0 · fixed in 0.3.0

Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing

• Cross-site scripting (XSS)
• CWE-436

>=1.6.0, <1.16.0 · fixed in 1.16.0

OctoPrint has possible file exfiltration via query parameters on upload endpoints

• Path traversal
• CWE-436

<1.11.8 || >=2.0.0rc1, <2.0.0rc3 · fixed in 1.11.8, 2.0.0rc3

vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations

• CWE-115
• CWE-436

>=0.11.0, <0.24.0 · fixed in 0.24.0

python-multipart: Semicolon treated as querystring field separator enables parameter smuggling

• HTTP request smuggling
• CWE-436

<0.0.30 · fixed in 0.0.30

python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters

• CWE-20
• CWE-436

<0.0.30 · fixed in 0.0.30

node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)

• CWE-436

<7.5.16 · fixed in 7.5.16

TYPO3 HTML Sanitizer allows Cross-site Scripting

• Cross-site scripting (XSS)
• CWE-436

<2.3.2 · fixed in 2.3.2

SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch

• Other injection
• CWE-20

>=5.4.46, <5.4.52 || >=6.4.14, <6.4.40 || >=7.1.7, <7.4.12 || >=8.0.0, <8.0.12 · fixed in 5.4.52, 6.4.40, 7.4.12, 8.0.12

LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body

• pnggroup libpng
• pnggroup libpng-apng
• CWE-436

Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification

• CWE-184
• CWE-436

>=6.1.0, <6.4.40 || >=7.0.0, <7.4.12 || >=8.0.0, <8.0.12 · fixed in 6.4.40, 7.4.12, 8.0.12

@hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parameters

• CWE-436

<6.0.2 · fixed in 6.0.2

Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

• Weak cryptography or TLS
• CWE-180

<1.9.11 || >=1.10.0, <1.10.10 || >=2.0.0, <2.0.18 || >=2.1.0, <2.1.14 || >=2.2.0, <2.2.3 · fixed in 1.9.11, 1.10.10, 2.0.18, 2.1.14, 2.2.3

SSRF allowlist bypass via percent-encoded host in hackney

• Server-side request forgery (SSRF)
• CWE-436

>=0.13.0, <4.0.1 · fixed in 4.0.1

authentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation

• authentik
• Other injection
• Authentication bypass

linux-entra-sso: PRT SSO cookie can leak to attacker-controlled hosts when broad host permissions are granted

• siemens linux-entra-sso
• Broken access control
• CWE-436

Next.js vulnerable to cache poisoning in React Server Component responses

• CWE-436

>=14.2.0, <15.5.16 || >=16.0.0, <16.2.5 · fixed in 15.5.16, 16.2.5

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

• CWE-140
• CWE-436

<2.4.1 || >=3.0.0, <3.1.2 · fixed in 2.4.1, 3.1.2

Server-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusion

• GitHub Enterprise Server
• Server-side request forgery (SSRF)
• CWE-436

Flight: HTTP method override enabled by default, facilitating CSRF escalation and middleware bypass

• CWE-436

<3.18.1 · fixed in 3.18.1

Fiber's cache middleware default key generator ignores query string, causing response mix-up across distinct query parameters

• Information disclosure
• CWE-436

<3.2.0 · fixed in 3.2.0

Heimdall has an authorization bypass via path normalization mismatch

• Path traversal
• CWE-436

<0.17.14 · fixed in 0.17.14

Heimdall: Case-sensitive host matching may lead to policy bypass

• CWE-178
• CWE-436

<0.17.14 · fixed in 0.17.14

Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation

• CWE-178
• CWE-436

<0.17.14 · fixed in 0.17.14

justhtml has sanitization bypass in custom policies and programmatic DOM

• Cross-site scripting (XSS)
• Denial of service

<1.17.0 · fixed in 1.17.0

@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

• CWE-436

<9.3.2 · fixed in 9.3.2

@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option

• CWE-436

<9.3.2 · fixed in 9.3.2

Official Clerk JavaScript SDKs: Middleware-based route protection bypass

• Broken access control
• CWE-436

>=0.0.1, <1.5.7 || >=2.0.0-snapshot.v20241206174604, <2.17.10 || >=3.0.0, <3.0.15 · fixed in 1.5.7, 2.17.10, 3.0.15