cve.bz

CWE-173: Improper Handling of Alternate Encoding

Filter

The product does not properly handle when an input uses an alternate encoding that is valid for the control sphere to which the input is being sent.

What the weakness is: CWE-173 at MITRE. All weaknesses

Related attack patterns (CAPEC): 12
  • CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters Likelihood: Medium · Severity: Medium
  • CAPEC-4 Using Alternative IP Address Encodings Likelihood: Medium · Severity: High
  • CAPEC-52 Embedding NULL Bytes Likelihood: High · Severity: High
  • CAPEC-53 Postfix, Null Terminate, and Backslash Likelihood: High · Severity: High
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-71 Using Unicode Encoding to Bypass Validation Logic Likelihood: Medium · Severity: High
  • CAPEC-72 URL Encoding Likelihood: High · Severity: High
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-80 Using UTF-8 Encoding to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-120 Double Encoding Likelihood: Low · Severity: Medium
  • CAPEC-267 Leverage Alternate Encoding Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-173, as MITRE names them. Credits.

Ask an AI about CWE-173

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-173: Improper Handling of Alternate Encoding and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/173.html and https://cve.bz/cve/cwe/173?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.9CVE-2026-103276EPSS 0.2%

    Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme templates and metadata. Attackers can use URL encoding to bypass extension validation and access sensi…

  2. 2.1CVE-2026-81638EPSS 0.2%

    Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-3…

  3. 7.4CVE-2026-19611EPSS 1.0%

    A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an …

  4. 8.7CVE-2026-10050EPSS 0.6%

    In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be I…

  5. 5.3CVE-2024-54158EPSS 0.3%

    In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding

  6. 5.5CVE-2023-26303EPSS 0.2%

    Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially crafted input.

  7. 5.5CVE-2023-26302EPSS 0.2%

    Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as input.

  8. 9.8CVE-2019-9636EPSS 7.7%

    Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached…