Skip to content
OpenAdvisories

Weakness (CWE)

CWE-573: Improper Following of Specification by Caller

Class Draft

The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.

How to prevent it (1 mitigation)

  1. Implementation

    When leveraging external functionality, such as an API, it is important that the caller does so in accordance with the requirements of the external functionality.

Source: MITRE CWE-573

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.4
    CVE-2026-104437

    Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling

    Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer ou…

    ZcashFoundation zebra zebrad crates.io
  • High 7.4
    CVE-2026-104435

    Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output

    Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corresponding output. Attackers can broadcast crafted V5 transactions with more inputs than outputs that…

    ZcashFoundation zebra zebrad zebra-script crates.io
  • High 7.3
    CVE-2026-89087

    The cstruct package before 6.3.0 for OCaml mishandles indexes.

    OCaml cstruct ocaml-cstruct ocaml-cstruct Debian Ubuntu
  • High 8.2
    CVE-2026-28498

    Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

    Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the inter…

    authlib authlib python-authlib python-authlib Debian Ubuntu PyPI
  • High 7.5
    CVE-2025-21601

    Junos OS: SRX and EX Series, MX240, MX480, MX960, QFX5120 Series: When web management is enabled for specific services an attacker may cause a CPU spike by sending genuine packets to the device

    An Improper Following of Specification by Caller vulnerability in web management (J-Web, Captive Portal, 802.1X, Juniper Secure Connect (JSC) of Juniper Networks Junos OS on SRX Series, EX Series, MX240, MX480, MX960, QFX5120 Series, allows an unauthenticated…

    Juniper Networks Junos OS Network devices