An impedance mismatch happens when two systems inspect the same data but interpret it differently. In security, that usually means a protection layer, such as a WAF, parser, proxy, or sanitizer, sees one structure while the application behind it sees another. The input may be valid for one component and misleading or incomplete for the other.
This matters because attackers can hide payloads in the gap between those interpretations. For example, multipart bodies and XML can be parsed differently depending on boundaries, encodings, or error handling, letting malicious content evade inspection, trigger bypasses, or cause denial of service. Defenders reduce this risk by keeping parsing logic consistent across layers, validating request bodies in the same way the backend does, and testing edge cases after patching or configuration changes. When security controls and applications disagree about what a request means, the attacker benefits from the confusion.