CWE-177
AllowedImproper Handling of URL Encoding (Hex Encoding)
Abstraction: Variant · Status: Draft
The product does not properly handle when all or part of an input has been URL encoded.
38 vulnerabilities reference this CWE, most recent first.
GHSA-P87C-HMGX-WG42
Vulnerability from github – Published: 2026-07-13 12:35 – Updated: 2026-07-13 18:30URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino.
This issue affects Apache Gravitino: from 1.0.0 before 1.2.1.
Users are recommended to upgrade to version 1.2.1, which fixes the issue.
{
"affected": [],
"aliases": [
"CVE-2026-41041"
],
"database_specific": {
"cwe_ids": [
"CWE-177"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-13T10:16:28Z",
"severity": "CRITICAL"
},
"details": "URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino.\n\nThis issue affects Apache Gravitino: from 1.0.0 before 1.2.1.\n\nUsers are recommended to upgrade to version 1.2.1, which fixes the issue.",
"id": "GHSA-p87c-hmgx-wg42",
"modified": "2026-07-13T18:30:44Z",
"published": "2026-07-13T12:35:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41041"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/4dnwg1qzb2yns1fkfmq0z45vmwyzytgz"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/07/13/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q5QW-H33P-QVWR
Vulnerability from github – Published: 2026-03-04 19:48 – Updated: 2026-03-05 15:26Summary
When using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization.
The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path.
Details
The routing layer preserved %2F as a literal string, while serveStatic decoded it into / before resolving the file path.
Example:
Request: /admin%2Fsecret.html
- Router sees:
/admin%2Fsecret.html→ does not match/admin/* - Static handler resolves:
/admin/secret.html
As a result, static files under the configured static root could be served without triggering route-based protections.
This only affects applications that both:
- Protect subpaths using route-based middleware, and
- Serve files from the same static root using
serveStatic.
This does not allow access outside the static root and is not a path traversal vulnerability.
Impact
An unauthenticated attacker could bypass route-based authorization for protected static resources by supplying paths containing encoded slashes.
Applications relying solely on route-based middleware to protect static subpaths may have exposed those resources.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "hono"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.12.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-29045"
],
"database_specific": {
"cwe_ids": [
"CWE-177"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-04T19:48:00Z",
"nvd_published_at": "2026-03-04T23:16:10Z",
"severity": "HIGH"
},
"details": "## Summary\n\nWhen using `serveStatic` together with route-based middleware protections (e.g. `app.use(\u0027/admin/*\u0027, ...)`), inconsistent URL decoding allowed protected static resources to be accessed without authorization.\n\nThe router used `decodeURI`, while `serveStatic` used `decodeURIComponent`. This mismatch allowed paths containing encoded slashes (`%2F`) to bypass middleware protections while still resolving to the intended filesystem path.\n\n\n## Details\n\nThe routing layer preserved `%2F` as a literal string, while `serveStatic` decoded it into `/` before resolving the file path.\n\nExample:\n\nRequest: `/admin%2Fsecret.html`\n\n- Router sees: `/admin%2Fsecret.html` \u2192 does not match `/admin/*`\n- Static handler resolves: `/admin/secret.html`\n\nAs a result, static files under the configured static root could be served without triggering route-based protections.\n\nThis only affects applications that both:\n\n- Protect subpaths using route-based middleware, and\n- Serve files from the same static root using `serveStatic`.\n\nThis does **not** allow access outside the static root and is **not** a path traversal vulnerability.\n\n\n## Impact\n\nAn unauthenticated attacker could bypass route-based authorization for protected static resources by supplying paths containing encoded slashes.\n\nApplications relying solely on route-based middleware to protect static subpaths may have exposed those resources.",
"id": "GHSA-q5qw-h33p-qvwr",
"modified": "2026-03-05T15:26:34Z",
"published": "2026-03-04T19:48:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29045"
},
{
"type": "WEB",
"url": "https://github.com/honojs/hono/commit/6a0607a929d888893f0c91d92dce2fcfdb3662a3"
},
{
"type": "PACKAGE",
"url": "https://github.com/honojs/hono"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Hono vulnerable to arbitrary file access via serveStatic vulnerability "
}
GHSA-RM99-52XQ-2R9W
Vulnerability from github – Published: 2023-03-07 00:30 – Updated: 2023-03-13 21:30A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service.
{
"affected": [],
"aliases": [
"CVE-2022-3854"
],
"database_specific": {
"cwe_ids": [
"CWE-177"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-06T23:15:00Z",
"severity": "MODERATE"
},
"details": "A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service.",
"id": "GHSA-rm99-52xq-2r9w",
"modified": "2023-03-13T21:30:39Z",
"published": "2023-03-07T00:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3854"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2139925"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RRG5-RJGQ-P223
Vulnerability from github – Published: 2024-11-12 00:30 – Updated: 2024-11-12 00:30Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.
{
"affected": [],
"aliases": [
"CVE-2024-23983"
],
"database_specific": {
"cwe_ids": [
"CWE-177"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-11T23:15:05Z",
"severity": "MODERATE"
},
"details": "Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.",
"id": "GHSA-rrg5-rjgq-p223",
"modified": "2024-11-12T00:30:36Z",
"published": "2024-11-12T00:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23983"
},
{
"type": "WEB",
"url": "https://docs.pingidentity.com/pingaccess/latest/release_notes/pa_811_rn.html"
},
{
"type": "WEB",
"url": "https://www.pingidentity.com/en/resources/downloads/pingaccess.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:M/U:Amber",
"type": "CVSS_V4"
}
]
}
GHSA-VP6J-J7W5-5XJJ
Vulnerability from github – Published: 2026-10-05 23:47 – Updated: 2026-10-05 23:47Summary
PyMongo percent-decoded the entire host section of a connection string before splitting it into individual host:port entries. A percent-encoded , or : in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client's seed list.
Impact
An application that interpolates untrusted input into a MongoDB connection string -- for example, a tenant name or hostname fragment taken from a request -- could be made to add an attacker-controlled server to the seed list. Because %2C and %3A survive most URL-safety checks and only become delimiters inside PyMongo's parser, input that looks like a single hostname to the application becomes two hosts to the driver. The client may then perform topology discovery and authentication against the attacker's host, exposing credentials, or route operations to it.
Unix domain socket paths, the only host identifiers that legitimately require percent-encoding, are not affected.
Patches
Fixed in PyMongo 4.18.2. Percent-decoding was moved into split_hosts and now applies only to Unix domain socket paths, identified by an unescaped .sock suffix before decoding, and only after splitting on ,.
Workarounds
Do not interpolate untrusted input into the host portion of a connection string. If unavoidable, reject or percent-decode-and-validate the value before building the URI.
Details
The decoding was introduced in PyMongo 3.5.0 (PYTHON-1282), where unquote_plus was applied to the whole host section in _validate_uri and, later, _parse_srv, before the string was split on , and :.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.18.1"
},
"package": {
"ecosystem": "PyPI",
"name": "pymongo"
},
"ranges": [
{
"events": [
{
"introduced": "3.5.0"
},
{
"fixed": "4.18.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-96748"
],
"database_specific": {
"cwe_ids": [
"CWE-177"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-05T23:47:07Z",
"nvd_published_at": "2026-09-24T19:17:20Z",
"severity": "HIGH"
},
"details": "### Summary\n\nPyMongo percent-decoded the entire host section of a connection string before splitting it into individual `host:port` entries. A percent-encoded `,` or `:` in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client\u0027s seed list.\n\n### Impact\n\nAn application that interpolates untrusted input into a MongoDB connection string -- for example, a tenant name or hostname fragment taken from a request -- could be made to add an attacker-controlled server to the seed list. Because `%2C` and `%3A` survive most URL-safety checks and only become delimiters inside PyMongo\u0027s parser, input that looks like a single hostname to the application becomes two hosts to the driver. The client may then perform topology discovery and authentication against the attacker\u0027s host, exposing credentials, or route operations to it.\n\nUnix domain socket paths, the only host identifiers that legitimately require percent-encoding, are not affected.\n\n### Patches\n\nFixed in PyMongo 4.18.2. Percent-decoding was moved into `split_hosts` and now applies only to Unix domain socket paths, identified by an unescaped `.sock` suffix before decoding, and only after splitting on `,`.\n\n### Workarounds\n\nDo not interpolate untrusted input into the host portion of a connection string. If unavoidable, reject or percent-decode-and-validate the value before building the URI.\n\n### Details\n\nThe decoding was introduced in PyMongo 3.5.0 (PYTHON-1282), where `unquote_plus` was applied to the whole host section in `_validate_uri` and, later, `_parse_srv`, before the string was split on `,` and `:`.",
"id": "GHSA-vp6j-j7w5-5xjj",
"modified": "2026-10-05T23:47:07Z",
"published": "2026-10-05T23:47:07Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j7w5-5xjj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96748"
},
{
"type": "WEB",
"url": "https://github.com/mongodb/mongo-python-driver/pull/3066"
},
{
"type": "WEB",
"url": "https://github.com/mongodb/mongo-python-driver/commit/1e7a56db4649b14c4c9a6ac20aa4a8d0d1bb238a"
},
{
"type": "WEB",
"url": "https://github.com/mongodb/mongo-python-driver/commit/640dd2383a1a2fb1a10e5222d50ebc0b22a61bd7"
},
{
"type": "PACKAGE",
"url": "https://github.com/mongodb/mongo-python-driver"
},
{
"type": "WEB",
"url": "https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst"
},
{
"type": "WEB",
"url": "https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2"
},
{
"type": "WEB",
"url": "https://www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters"
}
GHSA-WM77-Q74P-5763
Vulnerability from github – Published: 2018-07-27 17:06 – Updated: 2021-08-09 22:21Affected of superstatic are vulnerable to path traversal when used on Windows.
Additionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize \\ to / in paths on all platforms (a known example being Node.js v9.9.0).
Recommendation
Update to version 5.0.2 or later.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "superstatic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-177"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T22:00:48Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "Affected of `superstatic` are vulnerable to path traversal when used on Windows. \n\nAdditionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize `\\\\` to `/` in paths on all platforms (a known example being Node.js v9.9.0).\n\n\n## Recommendation\n\nUpdate to version 5.0.2 or later.",
"id": "GHSA-wm77-q74p-5763",
"modified": "2021-08-09T22:21:02Z",
"published": "2018-07-27T17:06:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/firebase/superstatic/pull/255"
},
{
"type": "WEB",
"url": "https://github.com/firebase/superstatic/commit/e396ff62f588732989137d6c40d46b310e51ef2b"
},
{
"type": "WEB",
"url": "https://github.com/firebase/superstatic/blob/v5.0.1/lib/providers/fs.js#L71"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/652"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Path Traversal in superstatic"
}
GHSA-X428-GHPX-8J92
Vulnerability from github – Published: 2026-04-16 22:34 – Updated: 2026-04-16 22:34Impact
@fastify/static v9.1.0 and earlier decodes percent-encoded path separators (%2F) before filesystem resolution, but Fastify's router treats them as literal characters. This creates a routing mismatch: route guards on /admin/* do not match /admin%2Fsecret.html, but @fastify/static decodes it to /admin/secret.html and serves the file.
Applications that rely on route-based middleware or guards to protect files served by @fastify/static can be bypassed with encoded path separators.
Patches
Upgrade to @fastify/static >= 9.1.1.
Workarounds
None. Upgrade to the patched version.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 9.1.0"
},
"package": {
"ecosystem": "npm",
"name": "@fastify/static"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "9.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-6414"
],
"database_specific": {
"cwe_ids": [
"CWE-177"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-16T22:34:03Z",
"nvd_published_at": "2026-04-16T13:16:52Z",
"severity": "MODERATE"
},
"details": "### Impact\n\n`@fastify/static` v9.1.0 and earlier decodes percent-encoded path separators (`%2F`) before filesystem resolution, but Fastify\u0027s router treats them as literal characters. This creates a routing mismatch: route guards on `/admin/*` do not match `/admin%2Fsecret.html`, but @fastify/static decodes it to `/admin/secret.html` and serves the file.\n\nApplications that rely on route-based middleware or guards to protect files served by @fastify/static can be bypassed with encoded path separators.\n\n### Patches\n\nUpgrade to `@fastify/static` \u003e= 9.1.1.\n\n### Workarounds\n\nNone. Upgrade to the patched version.",
"id": "GHSA-x428-ghpx-8j92",
"modified": "2026-04-16T22:34:03Z",
"published": "2026-04-16T22:34:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/fastify/fastify-static/security/advisories/GHSA-x428-ghpx-8j92"
},
{
"type": "WEB",
"url": "https://github.com/fastify/middie/security/advisories/GHSA-cxrg-g7r8-w69p"
},
{
"type": "WEB",
"url": "https://github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6414"
},
{
"type": "WEB",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/fastify/fastify-static"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "@fastify/static vulnerable to route guard bypass via encoded path separators"
}
GHSA-XQJC-V467-8FVF
Vulnerability from github – Published: 2026-09-30 15:31 – Updated: 2026-09-30 18:33A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.
This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.
{
"affected": [],
"aliases": [
"CVE-2026-76504"
],
"database_specific": {
"cwe_ids": [
"CWE-177"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-30T13:17:20Z",
"severity": "CRITICAL"
},
"details": "A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.\n\nThis vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.",
"id": "GHSA-xqjc-v467-8fvf",
"modified": "2026-09-30T18:33:25Z",
"published": "2026-09-30T15:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76504"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76504"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-44
Strategy: Input Validation
Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Mitigation MIT-20
Strategy: Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
CAPEC-120: Double Encoding
The adversary utilizes a repeating of the encoding process for a set of characters (that is, character encoding a character encoding of a character) to obfuscate the payload of a particular request. This may allow the adversary to bypass filters that attempt to detect illegal characters or strings, such as those that might be used in traversal or injection attacks. Filters may be able to catch illegal encoded strings, but may not catch doubly encoded strings. For example, a dot (.), often used in path traversal attacks and therefore often blocked by filters, could be URL encoded as %2E. However, many filters recognize this encoding and would still block the request. In a double encoding, the % in the above URL encoding would be encoded again as %25, resulting in %252E which some filters might not catch, but which could still be interpreted as a dot (.) by interpreters on the target.
CAPEC-468: Generic Cross-Browser Cross-Domain Theft
An attacker makes use of Cascading Style Sheets (CSS) injection to steal data cross domain from the victim's browser. The attack works by abusing the standards relating to loading of CSS: 1. Send cookies on any load of CSS (including cross-domain) 2. When parsing returned CSS ignore all data that does not make sense before a valid CSS descriptor is found by the CSS parser.
CAPEC-64: Using Slashes and URL Encoding Combined to Bypass Validation Logic
This attack targets the encoding of the URL combined with the encoding of the slash characters. An attacker can take advantage of the multiple ways of encoding a URL and abuse the interpretation of the URL. A URL may contain special character that need special syntax handling in order to be interpreted. Special characters are represented using a percentage character followed by two digits representing the octet code of the original character (%HEX-CODE). For instance US-ASCII space character would be represented with %20. This is often referred as escaped ending or percent-encoding. Since the server decodes the URL from the requests, it may restrict the access to some URL paths by validating and filtering out the URL requests it received. An attacker will try to craft an URL with a sequence of special characters which once interpreted by the server will be equivalent to a forbidden URL. It can be difficult to protect against this attack since the URL can contain other format of encoding such as UTF-8 encoding, Unicode-encoding, etc.
CAPEC-72: URL Encoding
This attack targets the encoding of the URL. An adversary can take advantage of the multiple way of encoding an URL and abuse the interpretation of the URL.