CWE-178.

HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service

• sysadminsmedia homebox
• CWE-178
• CWE-1024

ModSecurity: Response Body Inspection Bypass

• ModSecurity
• CWE-178

Kubewarden trusted-repos-policy: uppercase registry host bypasses registry/image deny rules

• kubewarden policies
• CWE-178

Samba: access control bypass via vfs_ceph_rgw case-insensitive open

• Samba
• Red Hat Enterprise Linux 10
• CWE-178

HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them

• CWE-178

Tanium addressed an incorrect privilege assignment vulnerability in Tanium Server.

• Tanium Server
• CWE-178

Consul vulnerable to an authorization bypass in service mesh registration

• HashiCorp Consul
• HashiCorp Consul Enterprise
• CWE-178

MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding

• misp-guard
• CWE-20
• CWE-178

undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

• CWE-178

>=7.15.0, <7.30.1 || >=8.0.0, <8.12.2 · fixed in 7.30.1, 8.12.2

Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

• Broken access control
• CWE-178

>=3.0.0 || >=4.0.0, <4.6.2 · fixed in 4.6.2

fastify is vulnerable to header validation bypass via case-sensitive propertyNames

• CWE-178

>=5.12.2, <5.12.6 · fixed in 5.12.6

Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing

• Apache Software Foundation Apache Camel
• CWE-178

Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching

• Apache Software Foundation Apache Camel
• CWE-178

Wheels: Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks…

• Wheels
• CWE-178

Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames

• Eclipse Foundation
• Server-side request forgery (SSRF)
• CWE-178

Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch

• wazuh-manager
• CWE-178

Open Computer Use through 1.0.0 Denylist Bypass via Case-Variant Bundle ID

• iFurySt open-computer-use
• CWE-178

svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences

• Denial of service
• CWE-178

<1.0.0 · fixed in 1.0.0

Docker Sandboxes OAuth response masking could be bypassed with a case-variant token host

• Docker Sandboxes
• CWE-178

Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions

• HashiCorp Vault
• HashiCorp Vault Enterprise
• CWE-178

Backstage: Scaffolder action input authorization bypass

• Broken access control
• CWE-178

<3.3.1 || >=3.4.0, <3.4.1 || >=4.0.0, <4.0.3 || >=4.0.4, <4.1.0 · fixed in 3.3.1, 3.4.1, 4.0.3, 4.1.0

Backstage: Inconsistent catalog property permission evaluation

• backstage
• @backstage plugin-catalog-backend
• Broken access control
• CWE-178

fastify vulnerable to header validation bypass via incomplete schema case normalization

• CWE-178

<5.12.2 · fixed in 5.12.2

Kiteworks Email Protection Gateway Improper Handling of Case Sensitivity

• Kiteworks Email Protection Gateway
• Code injection
• CWE-178

fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

• CWE-178

<2.4.7 || >=3.0.0, <3.1.8 || >=4.0.0, <4.1.5 · fixed in 2.4.7, 3.1.8, 4.1.5

Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass

• hugo
• CWE-178

Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass

• grav
• CWE-178

OpenClaw before 2026.7.1 Remote Code Execution via cron tool

• OpenClaw
• CWE-178

OpenClaw Matrix before 2026.8.1 Authorization Bypass via Case Folding

• openclaw matrix
• CWE-178

Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

• Broken access control
• CWE-178

<1.0.1-0.20260720133915-80bc87188ec3 · fixed in 1.0.1-0.20260720133915-80bc87188ec3

Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass

• Code injection
• Denial of service

<2.11.4 · fixed in 2.11.4

@fastify/static vulnerable to route guard bypass via path case-folding

• @fastify/static
• Broken access control
• CWE-178

Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter

• Dolibarr
• CWE-178

Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• CWE-178

Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation

• grokability snipe-it
• CWE-178

xmldom: HTML raw-text closing-tag case mismatch causes output amplification

• Denial of service
• CWE-178

>=0.9.0-beta.1, <0.9.12 · fixed in 0.9.12

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

• Broken access control
• CWE-178

<1.83.1 · fixed in 1.83.1

Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup

• MongoDB Server
• CWE-178

External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098

• Drupal External Authentication
• CWE-178

httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems

• Erlang OTP
• CWE-178

AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

• CWE-178
• CWE-625

>=2.1.26, <2.3.25 · fixed in 2.3.25

Google Chrome: Improper handling of case sensitivity in FileSystem in Google Chrome prior to…

• Google Chrome
• CWE-178

Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise

• Cloud Foundry UAA
• Cloud Foundry cf-deployment
• CWE-178

Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

• CWE-178

<2.0.4 · fixed in 2.0.4

FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass

• filebrowser
• CWE-178

Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison

• discourse
• CWE-178

Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth

• Authentication bypass
• CWE-178

<2.11.51 · fixed in 2.11.51

Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

• Broken access control
• CWE-178

>=3.21.7, <3.21.10 || >=4.4.7, <4.5.1 · fixed in 3.21.10, 4.5.1

Jenkins: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user…

• Jenkins
• CWE-178

Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.14
• CWE-178
• CWE-551

Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup

• CWE-178

>=0.1.0-alpha.3, <0.5.0 · fixed in 0.5.0

Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

• Authentication bypass
• Broken access control

<3.20.6.2 || >=3.21.0.CR1, <3.27.4.1 || >=3.28.0.CR1, <3.33.2.1 || >=3.34.0.CR1, <3.36.3 || >=3.37.0.CR1, <3.37.0 · fixed in 3.20.6.2, 3.27.4.1, 3.33.2.1, 3.36.3, 3.37.0

Principal/domain lookup without case normalization

• Logto
• CWE-178

JupyterLab: PyPI extension blocklist package-name canonicalization bypass

• CWE-178
• CWE-180

>=4.5.0, <4.5.10 || >=4.6.0, <4.6.2 · fixed in 4.5.10, 4.6.2

FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL

• freescout
• Authentication bypass
• CWE-178

Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

• Unrestricted file upload
• CWE-178

<1.6.0 · fixed in 1.6.0

SafeInstall agent guard shell parsing can miss raw package execution

• CWE-178
• CWE-693

<0.10.2 · fixed in 0.10.2

NousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivity

• NousResearch hermes-agent
• CWE-178
• CWE-697

Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity

• Flowise
• CWE-178

Authelia has an Edge Case Access Control Rule Mismatch

• Broken access control
• CWE-178

>=4.36.0, <4.39.20 · fixed in 4.39.20