CWE-177 · Injection and Smuggling
Improper Handling of URL Encoding (Hex Encoding)
19CVEs
SortMost likely exploited
19 CVEs with CWE-177 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-76504In CISA KEVExploitedCisco Catalyst SD-WAN Manager System Account Authorization Bypass VulnerabilityCisco · Cisco Catalyst SD-WAN Manager · CVSS 9.8 · 2026-09-30 | 9.8 | 39% | 2026-09-30 |
| CVE-2022-27780The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it…Haxx · https://github.com/curl/curl · CVSS 5.3 · 2022-06-01 | 5.3 | 2.5% | 2022-06-01 |
| CVE-2018-3718serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.HackerOne · serve node module · 2018-06-07 | – | 1.3% | 2018-06-07 |
| CVE-2026-41041Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.Apache Software Foundation · Apache Gravitino · CVSS 9.1 · 2026-07-13 | 9.1 | 0.6% | 2026-07-13 |
| CVE-2026-29045Hono: Arbitrary file access via serveStatic vulnerabilityhonojs · hono · CVSS 7.5 · 2026-03-04 | 7.5 | 0.6% | 2026-03-04 |
| CVE-2022-3854A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of…Redhat · ceph · CVSS 6.5 · 2023-03-06 | 6.5 | 0.6% | 2023-03-06 |
| CVE-2026-22031Fastify Middie Middleware Path Bypassfastify · middie · CVSS 8.4 · 2026-01-19 | 8.4 | 0.5% | 2026-01-19 |
| CVE-2026-59083Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypassApache Software Foundation · Apache Tomcat · CVSS 9.1 · 2026-07-14 | 9.1 | 0.5% | 2026-07-14 |
| CVE-2026-100409OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded pathsopennextjs · opennextjs-cloudflare · CVSS 7.5 · 2026-10-15 | 7.5 | 0.5% | 2026-10-15 |
| CVE-2024-23983Access rules for PingAccess may be circumvented with URL-encoded charactersPing Identity · PingAccess · CVSS 5.8 · 2024-11-11 | 5.8 | 0.4% | 2024-11-11 |
| CVE-2026-6414@fastify/static vulnerable to route guard bypass via encoded path separators@fastify/static · @fastify/static · CVSS 5.9 · 2026-04-16 | 5.9 | 0.4% | 2026-04-16 |
| CVE-2024-48866QTS, QuTS heroQNAP Systems Inc. · QTS · CVSS 2.3 · 2024-12-06 | 2.3 | 0.4% | 2024-12-06 |
| CVE-2026-118650Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served pathlabstack · echo · CVSS 7.5 · 2026-10-28 | 7.5 | 0.4% | 2026-10-28 |
| CVE-2026-15371Velociraptor Stored XSS in URL column typesRapid7 · Velociraptor · CVSS 8.1 · 2026-08-18 | 8.1 | 0.4% | 2026-08-18 |
| CVE-2026-96748Connection redirection via percent-encoded delimiter injection in connection string hostsMongoDB · Python Driver · CVSS 6.5 · 2026-09-24 | 6.5 | 0.4% | 2026-09-24 |
| CVE-2026-22037@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)fastify · fastify-express · CVSS 8.4 · 2026-01-19 | 8.4 | 0.3% | 2026-01-19 |
| CVE-2025-11990Improper Handling of URL Encoding (Hex Encoding) in GitLabGitLab · GitLab · CVSS 3.1 · 2025-11-15 | 3.1 | 0.3% | 2025-11-15 |
| CVE-2026-76172fast-uri vulnerable to host confusion via percent-encoded scheme normalizationfast-uri · fast-uri · CVSS 7.5 · 2026-08-24 | 7.5 | 0.2% | 2026-08-24 |
| CVE-2026-67448Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)axllent · mailpit · CVSS 6.5 · 2026-08-20 | 6.5 | 0.2% | 2026-08-20 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.