CWE-1471 Insufficiently Controlled Parser Differential

The product uses a common specification or format that is shared between multiple components or entities, but the components have different parsers that can interpret the same input in different, security-relevant ways.

• Integrity, Authorization, Access Control: Gain Privileges or Assume Identity, Bypass Protection Mechanism, Hide Activities, Alter Execution Logic, Unexpected State, Varies by Context — If an input is analyzed and/or processed by multiple components in security-related situations - such as analyzing headers or comparing identifiers - then a parser differential could lead to incorrect security decisions.

• [Architecture and Design, Implementation] If possible, ensure that the same parser is used by each component.

• Automated Dynamic Analysis: The different product components or entities could be tested using inputs with a variety of manipulations, such as differences in capitalization, whitespace, "boundary" tags, etc. The behavior of each component could be evaluated to see if the inputs are handled consistently.

• CVE-2026-83611: JavaScript-based DOM parser silently accepts certain malformed end tags such as "</a\nResidue>" due to a parser differential, possibly preventing the detection of malformed input.