目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

CWE-177 URL编码处理不恰当(Hex编码) 类漏洞列表 9

CWE-177 URL编码处理不恰当(Hex编码) 类弱点 9 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-177 属于输入验证缺陷，指软件未能正确处理经过 URL 十六进制编码的输入数据。攻击者常利用此漏洞绕过安全过滤机制，通过双重编码或混合编码方式注入恶意载荷，从而触发跨站脚本或命令注入等后续攻击。开发者应在接收输入后立即进行标准化解码，确保数据在统一格式下执行严格的白名单校验，并避免对已解码数据进行二次编码处理，以消除解析歧义。

MITRE CWE 官方描述
CWE：CWE-177 不当处理 URL 编码（Hex Encoding） 英文：当输入的全部或部分已被 URL 编码时，产品未能正确处理。
常见影响 (1)
IntegrityUnexpected State
缓解措施 (3)
Architecture and DesignAvoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.
ImplementationAssume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
ImplementationInputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
CVE ID标题CVSS风险等级Published
CVE-2026-6414 Fastify-Static 安全漏洞 — @fastify/static 5.9 Medium2026-04-16
CVE-2026-29045 Hono 安全漏洞 — hono 7.5 High2026-03-04
CVE-2026-22037 @fastify/express 安全漏洞 — fastify-express 8.4 High2026-01-19
CVE-2026-22031 @fastify/middie 安全漏洞 — middie 8.4 High2026-01-19
CVE-2025-11990 GitLab 安全漏洞 — GitLab 3.1 Low2025-11-15
CVE-2024-48866 QNAP Systems QTS和QNAP Systems QuTS hero 安全漏洞 — QTS 7.5 -2024-12-06
CVE-2022-3854 Red Hat Ceph 安全漏洞 — ceph 6.5 -2023-03-06
CVE-2022-27780 curl 代码问题漏洞 — https://github.com/curl/curl 7.5 -2022-06-01
CVE-2018-3718 serve 安全漏洞 — serve node module 7.5 -2018-06-07

CWE-177（URL编码处理不恰当(Hex编码)） 是常见的弱点类别，本平台收录该类弱点关联的 9 条 CVE 漏洞。