🛡️ Security

Hex Encoding

Representing a character in a URL or protocol as a percent sign followed by its two-digit hexadecimal byte value, such as %6a for the letter j. Improper or inconsistent handling of hex encoding (CWE-177) lets an attacker write a protected path in a form that an access rule fails to recognize but a downstream handler still decodes and serves.

📚 Deep Dive

Learn Article

How an Encoding Mismatch Between Two Parsers Defeats an Access Rule

When the layer that checks a path and the layer that routes it decode a URL differently, one encoded character slips past authorization. The mechanism behind CVE-2026-76504 and how to close it.

intermediate 5 min read

Back to Glossary