CWE-1471
Insufficiently Controlled Parser Differential
2026-10-28
00h00 +00:00
00h00 +00:00
Incomplete
指定 CWE 通知
随时了解指定 CWE 的变更。
名称: Insufficiently Controlled Parser Differential
The product uses a common specification or format that is shared
between multiple components or entities, but the components have
different parsers that can interpret the same input in different,
security-relevant ways.
基本信息
引入方式
Array适用平台
编程语言
类： Not Language-Specific (Undetermined)架构
类： Not Architecture-Specific (Undetermined)技术
类： Not Technology-Specific (Undetermined)类： Web Based (Undetermined)
常见后果
| 影响范围 | 影响 | 可能性 |
|---|---|---|
| Integrity Authorization Access Control | Gain Privileges or Assume Identity, Bypass Protection Mechanism, Hide Activities, Alter Execution Logic, Unexpected State, Varies by Context |
观察示例
| 参考资料 | 描述 |
|---|---|
CVE-2026-83611 | JavaScript-based DOM parser silently accepts certain malformed end tags such as "" due to a parser differential, possibly preventing the detection of malformed input. |
潜在缓解措施
Phases : Architecture and Design // Implementation检测方法
Automated Dynamic Analysis
漏洞映射说明
依据 : This CWE Entry is a Class and might have lower-level children that would be more appropriate备注 : Examine children of this entry to see if there is a better fit
参考资料
REF-1575
Parser Weakness Enumeration: Definition and Preliminary AssessmentDenley Lam, Letitia Li, Anthony Gabrielson.
https://ieeexplore.ieee.org/document/10305625
REF-1576
A Survey of Parser Differential Anti-PatternsSameed Ali, Sean W. Smith.
https://ieeexplore.ieee.org/document/10188627
REF-1577
Parser DifferentialNon-Human Identity Management Group.
https://nhimg.org/glossary/parser-differential/
提交记录
| 名称 | 组织 | 日期 | 发布日期 | Version |
|---|---|---|---|---|
| CWE Content Team | MITRE | 5.0 |
