CWE-436 Interpretation Conflict

kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection

Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules

Coraza has Cookie Parser Confusion

Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection

Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend

Apache Airflow Backfill API parser discrepancy permits cross-DAG authorization bypass

@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

elysia has Inefficient Algorithmic Complexity and Interpretation Conflict

LMDeploy has an SSRF bypass

fast-uri vulnerable to host confusion via failed IDN canonicalization

Traefik entrypoint header-name sanitization bypassed via request trailers

Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain

Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain

CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning

Mail: Email address spoofing via malformed RFC 2047 encoded-words

fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

OctoPrint has possible file exfiltration via query parameters on upload endpoints

Guzzle: Noncanonical host can bypass host-based checks