Use of Function with Inconsistent Implementations
CWE-474
The code uses a function that has inconsistent implementations across operating systems and versions.
The implementation of many functions varies by platform, and at times, even by different versions of the same platform. Implementation differences can include: Slight differences in the way parameters are interpreted, leading to inconsistent results. Some implementations of the function carry significant security risks. The function might not be defined on all platforms. The function might change which return codes it can provide, or change the meaning of its return codes.
We track 6 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7.
How this weakness is prevented
- Architecture and Design Requirements: Do not accept inconsistent behavior from the API specifications when the deviant behavior increases the risk level.
Latest Use of Function with Inconsistent Implementations vulnerabilities
- 8.8 High severity
Chrome: Use of Function with Inconsistent Implementations
Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a malicious file. (Chromium security severity: Medium)
- 9.8 Critical severity
vllm: Server-Side Request Forgery
vLLM is an inference and serving engine for large language models (LLMs). The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be bypassed in the load_from_url_async method due to inconsistent URL parsing behavior between the validation layer and the a
- 8.0 High severity
horilla: Unrestricted Upload of File with Dangerous Type
Horilla is a free and open source Human Resource Management System (HRMS). A critical File Upload vulnerability in versions prior to 1.5.0, with Social Engineering, allows authenticated users to deploy phishing attacks. By uploading a malicious HTML file disgu
- 8.8 High severity
Chrome: Use of Function with Inconsistent Implementations
Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Use of Function with Inconsistent Implementations
Inappropriate Implementation in DevTools in Google Chrome prior to 126.0.6478.54 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: High)
- 7.8 High severity
Omaha: Use of Function with Inconsistent Implementations
Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to bypass discretionary access control via a malicious file. (Chromium security severity: High)