CWE-436: Interpretation Conflict

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

This is generally found in proxies, firewalls, anti-virus software, and other intermediary devices that monitor, allow, deny, or modify traffic based on how the client or server is expected to behave.

Consequences

• Integrity, Other: Unexpected State, Varies by Context

Recent advisories

• GHSA-5x38-2vff-x55p — Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
• GHSA-9v7c-q64q-vv33 — Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes
• GHSA-pq4g-8rxf-4g29 — Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass
• GHSA-m665-v7pm-7grj — zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
• EEF-CVE-2026-115700 — SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney
• GHSA-8c8m-p3m8-cjg8 — Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
• GHSA-m943-m63m-w62w — Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
• GHSA-85x2-q946-cp5h — Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
• GHSA-6gq8-jgmh-3ffp — Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes
• GHSA-wjr9-j795-jxcr — fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
• GHSA-g73g-hqqh-jr95 — Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped
• GHSA-g57g-f23g-4646 — Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing
• GHSA-jvvf-x445-j334 — fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization
• GO-2026-6467 — Traefik entrypoint header-name sanitization bypassed via request trailers
• GHSA-wmmp-3585-3rmp — Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain

All advisories for CWE-436