CWE · MITRE source
CWE-177Improper Handling of URL Encoding (Hex Encoding)
The product does not properly handle when all or part of an input has been URL encoded.
Last updated: 16 October 2026 14:24 UTC
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
Detect
Catch it (CSF Detect / Respond)
—
Harden
Shrink the surface (DISA STIG)
—
Validate
Prove the fix (OWASP ASVS)
V1.2.2
NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
| No NIST controls proposed yet. | |||
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2026-76504 KEV | 9.9 | 9.8 | 0.0182 | 2026-09-30 |
CVE-2026-41041 | 6.9 | 9.1 | 0.0060 | 2026-07-13 |
CVE-2026-59083 | 6.8 | 9.1 | 0.0037 | 2026-07-14 |
CVE-2022-27780 UPD | 6.3 | 7.5 | 0.0252 | 2022-06-02 |
CVE-2026-22031 UPD | 6.1 | 8.4 | 0.0053 | 2026-01-19 |
CVE-2026-22037 UPD | 6.0 | 8.4 | 0.0035 | 2026-01-19 |
CVE-2026-29045 | 5.9 | 7.5 | 0.0062 | 2026-03-04 |
CVE-2026-15371 UPD | 5.8 | 8.1 | 0.0037 | 2026-08-18 |
CVE-2026-100409 | 5.8 | 7.5 | 0.0031 | 2026-10-15 |
CVE-2026-76172 UPD | 5.7 | 7.5 | 0.0023 | 2026-08-24 |
CVE-2022-3854 UPD | 5.2 | 6.5 | 0.0057 | 2023-03-06 |
CVE-2026-67448 UPD | 4.9 | 6.5 | 0.0022 | 2026-08-20 |
CVE-2026-96748 | 4.9 | 6.5 | 0.0026 | 2026-09-24 |
CVE-2018-3718 UPD | 4.7 | 5.3 | 0.0129 | 2018-06-07 |
CVE-2026-6414 UPD | 4.7 | 5.9 | 0.0045 | 2026-04-16 |
CVE-2024-48866 UPD | 4.4 | 5.3 | 0.0042 | 2024-12-06 |
CVE-2025-11990 | 2.8 | 3.1 | 0.0032 | 2025-11-15 |