CWE-1471
Insufficiently Controlled Parser Differential
2026-10-28
00h00 +00:00
00h00 +00:00
Incomplete
指定 CWE 通知
掌握特定 CWE 的任何變更。
名稱: Insufficiently Controlled Parser Differential
The product uses a common specification or format that is shared
between multiple components or entities, but the components have
different parsers that can interpret the same input in different,
security-relevant ways.
一般資訊
引入方式
Array適用平台
程式語言
類別： Not Language-Specific (Undetermined)架構
類別： Not Architecture-Specific (Undetermined)技術
類別： Not Technology-Specific (Undetermined)類別： Web Based (Undetermined)
常見後果
| 範圍 | 影響 | 可能性 |
|---|---|---|
| Integrity Authorization Access Control | Gain Privileges or Assume Identity, Bypass Protection Mechanism, Hide Activities, Alter Execution Logic, Unexpected State, Varies by Context |
觀察到的案例
| 參考資料 | 描述 |
|---|---|
CVE-2026-83611 | JavaScript-based DOM parser silently accepts certain malformed end tags such as "" due to a parser differential, possibly preventing the detection of malformed input. |
潛在緩解措施
Phases : Architecture and Design // Implementation偵測方法
Automated Dynamic Analysis
漏洞對應備注
理由說明 : This CWE Entry is a Class and might have lower-level children that would be more appropriate備註 : Examine children of this entry to see if there is a better fit
參考資料
REF-1575
Parser Weakness Enumeration: Definition and Preliminary AssessmentDenley Lam, Letitia Li, Anthony Gabrielson.
https://ieeexplore.ieee.org/document/10305625
REF-1576
A Survey of Parser Differential Anti-PatternsSameed Ali, Sean W. Smith.
https://ieeexplore.ieee.org/document/10188627
REF-1577
Parser DifferentialNon-Human Identity Management Group.
https://nhimg.org/glossary/parser-differential/
提交
| 名稱 | 機構 | 日期 | 發布日期 | Version |
|---|---|---|---|---|
| CWE Content Team | MITRE | 5.0 |
