CWE-838: Inappropriate Encoding for Output Context

Extended Description

This weakness can cause the downstream component to use a decoding method that produces different data than what the product intended to send. When the wrong encoding is used - even if closely related - the downstream component could decode the data incorrectly. This can have security consequences when the provided boundaries between control and data are inadvertently broken, because the resulting data could introduce control characters or special elements that were not sent by the product. The resulting data could then be used to bypass protection mechanisms such as input validation, and enable injection attacks. While using output encoding is essential for ensuring that communications between components are accurate, the use of the wrong encoding - even if closely related - could cause the downstream component to misinterpret the output. For example, HTML entity encoding is used for elements in the HTML body of a web page. However, a programmer might use entity encoding when generating output for that is used within an attribute of an HTML tag, which could contain functional Javascript that is not affected by the HTML encoding. While web applications have received the most attention for this problem, this weakness could potentially apply to any type of product that uses a communications stream that could support multiple encodings.

Code Examples & CVEs

Demonstrative Examples

This code dynamically builds an HTML page using POST data:

The programmer attempts to avoid XSS exploits (CWE-79) by encoding the POST values so they will not be interpreted as valid HTML. However, the htmlentities() encoding is not appropriate when the data are used as HTML attributes, allowing more attributes to be injected.

BadPHP

$username = $_POST['username'];$picSource = $_POST['picsource'];$picAltText = $_POST['picalttext'];                      ...                                            echo "<title>Welcome, " . htmlentities($username) ."</title>";echo "<img src='". htmlentities($picSource) ." ' alt='". htmlentities($picAltText) . '" />';                      ...

Observed CVE Examples (1)

CVE-2009-2814

Server does not properly handle requests that do not contain UTF-8 data; browser assumes UTF-8, allowing XSS.

View Details

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Verify controls for CWE-838 with SSDF evidence

Use NIST SSDF verification and vulnerability-response practices to detect CWE-838, Inappropriate Encoding for Output Context, throughout the product lifecycle. Derive review questions, static or dynamic checks, and negative tests from the CWE's causal behavior; define the components and lifecycle stages each check covers; and retain findings with enough evidence to distinguish the root cause from symptoms and impacts. Track escapes and false negatives, then improve the verification plan after every confirmed occurrence.

NIST SP 800-218 Secure Software Development Framework — National Institute of Standards and Technology

Apply Output Encoding controls for Inappropriate Encoding for Output Context

MITRE associates mitigation with Implementation, and Architecture and Design; the listed strategies include Output Encoding, and Libraries or Frameworks; documented detection approaches include Automated Static Analysis. Use these source-defined anchors to turn CWE-838 into implementation, review, and verification checks for the affected component.

CWE-838: Inappropriate Encoding for Output Context — MITRE CWE

Triage CWE-838 against known exploitation evidence

Use CISA's Known Exploited Vulnerabilities catalog to test whether a vulnerability mapped to CWE-838, Inappropriate Encoding for Output Context, has evidence of exploitation in the wild. Confirm the CVE-to-CWE root-cause mapping independently before attaching the example, then capture the affected product, required action, and remediation deadline. A missing KEV match is not evidence that the weakness is unexploited, and a KEV entry must not be generalized to every occurrence of this CWE.

Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security Agency

Apply precise root-cause mapping to CWE-838

Apply MITRE's full root-cause mapping guidance when using CWE-838, Inappropriate Encoding for Output Context. Separate weakness language from attacker prerequisites and technical impact, check the entry's abstraction and vulnerability-mapping notes, and prefer the most specific Base or Variant supported by the evidence. Record the rejected alternatives and require an independent review before the mapping is used for remediation trends or program metrics.

CVE to CWE Root Cause Mapping Guidance — MITRE CWE

Validate CWE-838 with root-cause mapping checks

Apply MITRE's root-cause mapping quick tips to CWE-838, Inappropriate Encoding for Output Context. Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.

CVE to CWE Root Cause Mapping Quick Tips — MITRE CWE

Frequently Asked Questions

What is CWE-838: Inappropriate Encoding for Output Context?+

CWE-838: Inappropriate Encoding for Output Context is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product uses or specifies an encoding when generating output to a downstream component, but the specified encoding is not the same as the encoding that is expected by the downstream component. This weakness can cause the downstream component to use a decoding method that produces different data than what the product intended to send. When the wrong encoding is used - even if closely related - the downstream component could decode the data incorrectly. This can have security consequences when the provided boundaries between control and data are inadvertently broken, because the resulting data could introduce control characters or special elements that were not sent by the product. The resulting data could then be used to bypass protection mechanisms such as input validation, and enable injection attacks. While using output encoding is essential for ensuring that communications between components are accurate, the use of the wrong encoding - even if closely related - could cause the downstream component to misinterpret the output. For example, HTML entity encoding is used for elements in the HTML body of a web page. However, a programmer might use entity encoding when generating output for that is used within an attribute of an HTML tag, which could contain functional Javascript that is not affected by the HTML encoding. While web applications have received the most attention for this problem, this weakness could potentially apply to any type of product that uses a communications stream that could support multiple encodings.

What are the security consequences of Inappropriate Encoding for Output Context?+

If exploited, CWE-838 (Inappropriate Encoding for Output Context) it can compromise Integrity, Confidentiality and Availability, leading to outcomes such as Modify Application Data and Execute Unauthorized Code or Commands.

How do you prevent or mitigate Inappropriate Encoding for Output Context?+

Recommended mitigations for CWE-838 include: Use context-aware encoding. That is, understand which encoding is being used by the downstream component, and ensure that this encoding is used. If an encoding can be specified, do so, instead of assuming that the default encoding is the same as the default being assumed by the downstream component. Where possible, use communications protocols or data formats that provide strict boundaries between control and data. If this is not feasible, ensure that the protocols or formats allow the communicating components to explicitly state which encoding/decoding method is being used. Some template frameworks provide built-in support.

Which programming languages are affected by Inappropriate Encoding for Output Context?+

CWE-838 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Inappropriate Encoding for Output Context?+

MITRE documents real CVEs mapped to CWE-838, including CVE-2009-2814. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-838 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-838: Inappropriate Encoding for Output Context

Extended Description

Technical Details

Applicable To

Security Consequences

Scope

Impact

Mitigation Strategies

Phase

Description

Strategy