CWE-172 Encoding Error
Description
The product does not properly encode or decode the data, resulting in unexpected values.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-172 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-pc5q-qfxp-ggqv | CVE-2026-104774 | MODERATE |
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass |
2026-10-08 | |
| GHSA-7822-rcf6-97fx | CVE-2026-106122 | MODERATE |
RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers |
2026-10-07 | |
| GHSA-jvvf-x445-j334 | CVE-2026-86818 | MODERATE |
fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization |
2026-09-29 | |
| GHSA-h5x3-xfc9-m39h | CVE-2026-48784 | MODERATE | - |
Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization |
2026-06-15 |
| GHSA-vghf-hv5q-vc2g | CVE-2025-12758 | HIGH |
Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements |
2026-01-31 | |
| GHSA-cx7h-h87r-jpgr | - | LOW | - |
The kstring integration in gix-attributes is unsound |
2025-01-21 |
| GHSA-3c32-4hq9-6wgj | CVE-2024-48909 | LOW |
SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not |
2024-10-14 | |
| GHSA-534w-937m-v7x3 | CVE-2018-3777 | CRITICAL |
restforce vulnerable to Improper Input Validation |
2023-06-09 | |
| GHSA-wqxc-qrq4-w5v4 | CVE-2020-36213 | HIGH | - |
Update unsound DrainFilter and RString::retain |
2022-06-15 |
| GHSA-c99r-67x4-whj6 | CVE-2021-33604 | LOW |
Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19 |
2021-10-05 | |
| GHSA-8vfw-v2jv-9hwc | - | LOW |
Reflected cross-site scripting in development mode handler in Vaadin |
2021-06-24 |