CWE-173 · 8 records

Improper Handling of Alternate Encoding

CVEs in this class

8 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
41Plan	CVE-2019-9636No exploit	Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFpython · python · CWE-173 Pre-auth	Critical9.8	—	7.7%	Mar 8, 2019
34Monitor	CVE-2026-10050No exploit	Digest authentication lossy encodingeclipse · jetty · CWE-173 Pre-auth	High8.7	—	0.6%	Aug 4, 2026
29Monitor	CVE-2026-19611No exploit	Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth foldingred hat · red hat build of apache camel 4 for quarkus 3 · CWE-173 Pre-auth	High7.4	—	0.8%	Aug 20, 2026
27Monitor	CVE-2026-103276No exploit	Ghost before 6.20.0 File Read via URL Encoding Bypasstryghost · ghost · CWE-173 Pre-auth	Medium6.9	—	0.2%	Oct 1, 2026
22Monitor	CVE-2023-26303No exploit	markdown-it-py crash on null assertionsexecutablebooks · markdown-it-py · CWE-173 Denial of service	Medium5.5	—	0.2%	Feb 22, 2023
22Monitor	CVE-2023-26302No exploit	markdown-it-py CLI crash on invalid UTF-8 charactersexecutablebooks · markdown-it-py · CWE-173 Denial of service	Medium5.5	—	0.2%	Feb 22, 2023
21Monitor	CVE-2024-54158No exploit	In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encodingjetbrains · youtrack · CWE-173 Pre-auth	Medium5.3	—	0.3%	Dec 4, 2024
8Monitor	CVE-2026-81638No exploit	Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entryash-project · ash_double_entry · CWE-173	Low2.1	—	0.2%	Sep 7, 2026

CVE-2019-9636
41Plan
Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NF
CriticalCVSS 9.8No exploitEPSS 8%
- Pre-auth
python · pythonMar 8, 2019
CVE-2026-10050
34Monitor
Digest authentication lossy encoding
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
eclipse · jettyAug 4, 2026
CVE-2026-19611
29Monitor
Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding
HighCVSS 7.4No exploitEPSS 1%
- Pre-auth
red hat · red hat build of apache camel 4 for quarkus 3Aug 20, 2026
CVE-2026-103276
27Monitor
Ghost before 6.20.0 File Read via URL Encoding Bypass
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
tryghost · ghostOct 1, 2026
CVE-2023-26303
22Monitor
markdown-it-py crash on null assertions
MediumCVSS 5.5No exploitEPSS 0%
- Denial of service
executablebooks · markdown-it-pyFeb 22, 2023
CVE-2023-26302
22Monitor
markdown-it-py CLI crash on invalid UTF-8 characters
MediumCVSS 5.5No exploitEPSS 0%
- Denial of service
executablebooks · markdown-it-pyFeb 22, 2023
CVE-2024-54158
21Monitor
In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
jetbrains · youtrackDec 4, 2024
CVE-2026-81638
8Monitor
Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry
LowCVSS 2.1No exploitEPSS 0%
ash-project · ash_double_entrySep 7, 2026

All vulnerability classes