ES2604-7d364742 - CWE-50 modification add CanPrecede of CWE-601

[cmullaly-mitre]

Submission File: ES2604-7d364742-mod-CWE-50-add-relationship.txt

ID: ES2604-7d364742

SUBMISSION DATE: 2026-04-15 08:02:01

NAME: CWE-50 modification add CanPrecede of CWE-601

DESCRIPTION:

We suggest adding a CanPrecede relation of CWE-601. Similarly, CWE-601
should document CanFollow of CWE-50.

Context: There has been multiple open-redirect CVE entries caused by
mistreatment of double slashes in the Location header. Those programs
generally accept user input that is prefixed with a slash, and use it
directly for redirecting purposes. Because double-slash-prefixed URLs are
schema-relative and not origin-relative, this produces open redirect.

Example CVEs: CVE-2025-54793, CVE-2021-23387, CVE-2021-22964,
CVE-2020-28724

[cmullaly-mitre]

ES2604-7d364742 has been assigned to a member of the CWE Content Team as part of the INITIAL REVIEW phase. We will provide feedback as soon as possible.

The review process will analyze the submission for scope and submission problems as documented here:

• Submission problems
• Scope exclusions

After initial review, we might need to ask you additional questions (CONSULTATION phase) to ensure that the submitted information is accurate, properly understood, and (for new entry proposals) falls within CWE's scope. Afterward, we will make a DECISION as to whether a new CWE entry is needed, or if an existing entry needs to be modified. If a new entry is needed, we will then request more detailed content from you (SUPPORTING ANALYSIS). See the following URL for more details:

https://cwe.mitre.org/community/submissions/guidelines.html