{"@ID": "1471", "@Name": "Insufficiently Controlled Parser Differential", "@Abstraction": "Class", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The product uses a common specification or format that is shared\n\t\tbetween multiple components or entities, but the components have\n\t\tdifferent parsers that can interpret the same input in different,\n\t\tsecurity-relevant ways.", "Related_Weaknesses": {"Related_Weakness": [{"@Nature": "ChildOf", "@CWE_ID": "436", "@View_ID": "1000", "@Ordinal": "Primary"}, {"@Nature": "CanPrecede", "@CWE_ID": "444", "@View_ID": "1000", "@Ordinal": "Primary"}]}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}, "Architecture": {"@Class": "Not Architecture-Specific", "@Prevalence": "Undetermined"}, "Technology": [{"@Class": "Not Technology-Specific", "@Prevalence": "Undetermined"}, {"@Class": "Web Based", "@Prevalence": "Undetermined"}]}, "Modes_Of_Introduction": {"Introduction": {"Phase": ["Requirements", "Architecture and Design"], "Note": {"xhtml:p": "The product's components might be required to follow a\n\t\t\t\tspecification that is incomplete in ways that do not sufficiently\n\t\t\t\tcover security expectations, and/or allows for implementation-specific\n\t\t\t\tvariations that may be security-critical.", "#text_blocks": ["The product's components might be required to follow a\n\t\t\t\tspecification that is incomplete in ways that do not sufficiently\n\t\t\t\tcover security expectations, and/or allows for implementation-specific\n\t\t\t\tvariations that may be security-critical."]}}}, "Common_Consequences": {"Consequence": {"Scope": ["Integrity", "Authorization", "Access Control"], "Impact": ["Gain Privileges or Assume Identity", "Bypass Protection Mechanism", "Hide Activities", "Alter Execution Logic", "Unexpected State", "Varies by Context"], "Note": {"xhtml:p": "If an input is analyzed and/or processed by multiple components\n\t\t\tin security-related situations - such as analyzing headers or\n\t\t\tcomparing identifiers - then a parser differential could lead to\n\t\t\tincorrect security decisions.", "#text_blocks": ["If an input is analyzed and/or processed by multiple components\n\t\t\tin security-related situations - such as analyzing headers or\n\t\t\tcomparing identifiers - then a parser differential could lead to\n\t\t\tincorrect security decisions."]}}}, "Detection_Methods": {"Detection_Method": {"Method": "Automated Dynamic Analysis", "Description": {"xhtml:p": "The different product components or entities could be tested\n\t\t\t\tusing inputs with a variety of manipulations, such as differences in\n\t\t\t\tcapitalization, whitespace, \"boundary\" tags, etc. The behavior of each\n\t\t\t\tcomponent could be evaluated to see if the inputs are handled\n\t\t\t\tconsistently.", "#text_blocks": ["The different product components or entities could be tested\n\t\t\t\tusing inputs with a variety of manipulations, such as differences in\n\t\t\t\tcapitalization, whitespace, \"boundary\" tags, etc. The behavior of each\n\t\t\t\tcomponent could be evaluated to see if the inputs are handled\n\t\t\t\tconsistently."]}}}, "Potential_Mitigations": {"Mitigation": {"Phase": ["Architecture and Design", "Implementation"], "Description": {"xhtml:p": "If possible, ensure that the same parser is used by each component.", "#text_blocks": ["If possible, ensure that the same parser is used by each component."]}, "Effectiveness": "High", "Effectiveness_Notes": {"xhtml:p": "This might be difficult to do if the affected\n\t\t\tproduct has some components or entities that are not directly under\n\t\t\tits control, such as with firewalls managing traffic between diverse\n\t\t\tsystems that might have a variety of libraries across different\n\t\t\toperating systems, programming languages, etc.", "#text_blocks": ["This might be difficult to do if the affected\n\t\t\tproduct has some components or entities that are not directly under\n\t\t\tits control, such as with firewalls managing traffic between diverse\n\t\t\tsystems that might have a variety of libraries across different\n\t\t\toperating systems, programming languages, etc."]}}}, "Observed_Examples": {"Observed_Example": {"Reference": "CVE-2026-83611", "Description": "JavaScript-based DOM parser silently accepts certain\n\t\t\t\tmalformed end tags such as \"</a\\nResidue>\" due to a parser differential,\n\t\t\t\tpossibly preventing the detection of malformed input.", "Link": "https://www.cve.org/CVERecord?id=CVE-2026-83611"}}, "References": {"Reference": [{"@External_Reference_ID": "REF-1575"}, {"@External_Reference_ID": "REF-1576"}, {"@External_Reference_ID": "REF-1577"}]}, "Mapping_Notes": {"Usage": "Allowed-with-Review", "Rationale": "This CWE Entry is a Class and might have lower-level children that would be more appropriate", "Comments": "Examine children of this entry to see if there is a better fit", "Reasons": {"Reason": {"@Type": "Abstraction"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2026-10-26", "Submission_Version": "5.0", "Submission_ReleaseDate": "2026-10-28"}, "Contribution": {"@Type": "Content", "Contribution_Name": "Denley Lam", "Contribution_Date": "2023-11-14", "Contribution_Version": "5.0", "Contribution_ReleaseDate": "2026-10-28", "Contribution_Comment": "Suggested coverage with Parser Weakness Enumeration"}}, "entry_type": "Weakness"}