Improper Handling of Unexpected Data Type
CWE-241
The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z).
We track 13 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.6.
How this weakness is prevented
- Implementation: Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
Latest Improper Handling of Unexpected Data Type vulnerabilities
- 7.7 High severity
Kong Enteprise Gateway: Improper Handling of Unexpected Data Type
A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway Enterprise. The affected code does not properly validate that the JWT signing algorithm is compatible
- 7.5 High severity
HPE IceWall products: Improper Handling of Unexpected Data Type
A potential security vulnerability in HPE IceWall Federation Agent and Proxy could allow a remote unauthenticated attacker to cause a denial of service (DoS).
- 7.5 High severity
HP LaserJet MFP M232-M237 Printer Series: Improper Handling of Unexpected Data Type
The HP LaserJet MFP M232-M237 Printer Series may be vulnerable to a denial of service attack when a specially crafted request message is sent via Internet Printing Protocol (IPP).
- 7.5 High severity
speaker: Uncontrolled Resource Consumption
All versions of the package speaker are vulnerable to Denial of Service (DoS) when providing unexpected input types to the channels property of the Speaker object makes it possible to reach an assert macro. Exploiting this vulnerability can lead to a process c
- 7.5 High severity
images: Uncontrolled Resource Consumption
All versions of the package images are vulnerable to Denial of Service (DoS) due to providing unexpected input types to several different functions. This makes it possible to reach an assert macro, leading to a process crash. **Note:** By providing some specif
- 7.5 High severity
PowerScale OneFS: Improper Handling of Unexpected Data Type
Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an improper handling of unexpected data type vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service.
- 7.5 High severity
NodeBB: Improper Check for Unusual or Exceptional Conditions
Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking `eventName.startsWith()` or `eventName.toString()`, while processing Socket.IO messages via crafted Socket.IO messages containing array or object type for
- 8.1 High severity
TRÅDFRI smart lighting system: Improper Handling of Unexpected Data Type
An attacker sending a single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI bulb blink, and if they replay (i.e. resend) the same frame multiple times, the bulb performs a factory reset. This causes the bulb to lose configuration information about th
- 7.5 High severity
Routinator: Improper Handling of Unexpected Data Type
In NLnet Labs Routinator 0.9.0 up to and including 0.11.2, due to a mistake in error handling, data in RRDP snapshot and delta files that isn’t correctly base 64 encoded is treated as a fatal error and causes Routinator to exit. Worst case impact of this vulne
- 7.5 High severity
Swift Corelib-Foundation: Incorrect Type Conversion or Cast
A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JSON document containing a type mismatch. This vulnerability is caused by the interaction between a deserialization mecha
- 8.2 High severity
nokogiri: Access of Resource Using Incompatible Type
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads
- 7.5 High severity
Cisco Firepower Threat Defense Software: Improper Handling of Unexpected Data Type
A vulnerability in the Security Intelligence feed feature of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the Security Intelligence DNS feed. This vulnerability is due to incorrect feed update processi
- 7.5 High severity
SwiftNIO HTTP2: Improper Handling of Unexpected Data Type
A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical error after f