CWEweakness
CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data
- Abstraction
- Base
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
Common consequences
• Access Control, Integrity: Bypass Protection Mechanism, Modify Application Data — An attacker could package untrusted data with trusted data to bypass protection mechanisms to gain access to and possibly modify sensitive data.
Observed examples
• CVE-2002-0018: Does not verify that trusted entity is authoritative for all entities in its response.
• CVE-2006-5462: use of extra data in a signature allows certificate signature forging
Related
Attack pattern · CAPEC (3)
Observed example · CVE (2)
- CVE-2006-5462 Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and… vulnerability
- CVE-2002-0018 In Microsoft Windows NT and Windows 2000, a trusting domain that receives authorization information from a trusted domain does not verify… vulnerability
Child of · CWE (1)
- CWE-345 Insufficient Verification of Data Authenticity weakness
Referenced by CAPEC · weakness (3)
Referenced by CVE · weakness (51)
- CVE-2026-112256 Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing… vulnerability
- CVE-2026-102527 Nuxt OG Image generates OG Images with Vue templates in Nuxt. vulnerability
- CVE-2026-100755 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2… vulnerability
- CVE-2026-48100 Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant transactions. vulnerability
- CVE-2026-95985 The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions… vulnerability
- CVE-2026-62364 wlc is a Weblate command-line client using Weblate's REST API. vulnerability
- CVE-2026-19033 For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final… vulnerability
- CVE-2026-78301 A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. vulnerability
- CVE-2026-54047 Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. vulnerability
- CVE-2026-74916 The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while… vulnerability
- CVE-2026-15387 GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1… vulnerability
- CVE-2026-54625 django CMS is a content management system powered by Django. vulnerability
- CVE-2026-50252 In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that… vulnerability
- CVE-2026-33612 A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning. vulnerability
- CVE-2026-41120 Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data… vulnerability
- CVE-2026-46342 Nuxt is an open-source web development framework for Vue.js. vulnerability
- CVE-2026-45602 No cwe for this issue in Windows DHCP Server allows an unauthorized attacker to perform tampering over a network. vulnerability
- CVE-2026-42960 NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. vulnerability
- CVE-2026-44572 Next.js is a React framework for building full-stack web applications. vulnerability
- CVE-2026-32162 Acceptance of extraneous untrusted data with trusted data in Windows COM allows an unauthorized attacker to elevate privileges locally. vulnerability
- CVE-2026-35641 OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to… vulnerability
- CVE-2026-1642 A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. vulnerability
- CVE-2025-68269 In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSH vulnerability
- CVE-2025-1680 An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switches, which allows… vulnerability
- CVE-2025-11411 NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks. vulnerability
- CVE-2025-40778 Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the… vulnerability
- CVE-2025-11703 The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 9.0.48. vulnerability
- CVE-2025-40776 A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack. vulnerability
- CVE-2025-5994 A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client… vulnerability
- CVE-2025-48804 Acceptance of extraneous untrusted data with trusted data in Windows BitLocker allows an unauthorized attacker to bypass a security feature… vulnerability
Referenced by CWE · has member (1)
- CWE-884 CWE Cross-section view
Referenced by CWE · peer of (1)
- CWE-501 Trust Boundary Violation weakness