CWE-436 is an interpretation conflict: Product A handles inputs or steps differently than Product B, so A acts wrongly based on its picture of B's state. MITRE says this is generally found in proxies, firewalls, antivirus software and other intermediaries that allow, deny or modify traffic based on how a client or server is expected to behave.
How it happens
A filter looks at a request and decides it is safe. The server behind it reads the same bytes differently and does something else. The attacker lives in the gap.
MITRE's observed examples:
- Requests with multiple Content-Length headers, which is non-standard, bypassed filters or poisoned a web cache (CVE-2005-1215).
- Mixed case Content-Type and Content-Disposition headers bypassed an antivirus product while clients still processed them (CVE-2002-0485).
- FTP clients sending a command with "PASV" in the argument made firewalls misread the server's error as a valid response, allowing filter bypass (CVE-2002-1978).
What an attacker gains
The record lists integrity impact and an unexpected state, varying by context. Practically: filters that stop filtering and caches that serve poisoned content.
How to find it
No detection methods are listed. Try differential testing: send the same ambiguous input to the intermediary and to the backend, and compare how each parses it. Ambiguity cases include duplicate headers, odd casing and malformed lengths.
How to fix it
- Reject ambiguous or non-standard input at the edge instead of guessing.
- Keep intermediaries and backends on compatible parsers, and update them together.
- Normalize traffic in one place so both sides see the same thing.
- Do not rely on a single filter as the only defense. Validate again at the destination.
Quick check
Why are proxies especially exposed?
They must predict how another system will read the traffic. Any difference in parsing is a bypass.
