CWE-178.

@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapter

• Information disclosure
• CWE-178

>=1.0.0-preview.97, <1.0.0-preview.102 · fixed in 1.0.0-preview.102

Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion

• Broken access control
• CWE-178

<0.14.3 · fixed in 0.14.3

jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories

• CWE-178

<0.54.0 · fixed in 0.54.0

Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247

• XML external entities (XXE)
• CWE-178

<1.19.4 · fixed in 1.19.4

OpenFGA Improper Policy Enforcement

• CWE-178

<1.18.0 · fixed in 1.18.0

MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence

• CWE-41
• CWE-178

<0.11.4 · fixed in 0.11.4

Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher

• Broken access control
• CWE-178

>=3.11.0, <3.21.7 || >=4.0.0, <4.4.7 · fixed in 3.21.7, 4.4.7

TYPO3 CMS has Broken Access Control in its Form Framework

• Broken access control
• CWE-178

<10.4.57 || >=11.0.0, <11.5.51 || >=12.0.0, <12.4.46 || >=13.0.0, <13.4.31 || >=14.0.0, <14.3.3 · fixed in 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3

HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation

• haxtheweb haxcms-php
• Unrestricted file upload
• CWE-178

Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling

• CWE-178

<5.2.15 || >=6.0.0, <6.0.6 · fixed in 5.2.15, 6.0.6

Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects

• CWE-178

>=1.4.0, <1.18.3 · fixed in 1.18.3

Klaw: user lockout due to case sensitivity inconsistency

• Aiven-Open klaw
• CWE-20
• CWE-178

Authelia Missing Username Canonicalization in Basic Auth (LDAP)

• Authentication bypass
• CWE-178

>=4.38.0, <4.39.20 · fixed in 4.39.20

tuf has platform-dependent delegation path matching

• CWE-178

<7.0.0 · fixed in 7.0.0

Envoy AI Proxy - MCP Message Smuggling Vulnerability

• CWE-178

<0.6.0 · fixed in 0.6.0

Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound Filtering

• CWE-178
• CWE-791

>=3.18.0, <4.14.6 || >=4.15.0, <4.18.2 · fixed in 4.14.6, 4.18.2

Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files

• CWE-20
• CWE-176

>=2.7.0, <2.11.3 · fixed in 2.11.3

FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

• CWE-20
• CWE-176

>=1.11.2, <1.12.3 · fixed in 1.12.3

Apache Tomcat: LockOutRealm treats user names as case-sensitive

• CWE-178

<9.0.118 || >=10.1.0-M1, <10.1.55 || >=11.0.0-M1, <11.0.22 · fixed in 9.0.118, 10.1.55, 11.0.22

Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-178

Apache Camel has an incomplete fix for CVE-2025-27636

• CWE-178

>=3.0.0, <4.14.6 || >=4.15.0, <4.18.2 || >=4.19.0, <4.20.0 · fixed in 4.14.6, 4.18.2, 4.20.0

Heimdall: Case-sensitive host matching may lead to policy bypass

• CWE-178
• CWE-436

<0.17.14 · fixed in 0.17.14

Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation

• CWE-178
• CWE-436

<0.17.14 · fixed in 0.17.14

Multiple security fixes in justhtml

• Cross-site scripting (XSS)
• CWE-20

<1.16.0 · fixed in 1.16.0

justhtml includes multiple security fixes

• Cross-site scripting (XSS)
• CWE-20

<1.15.0 · fixed in 1.15.0

Gotenberg has incomplete fix for ExifTool arbitrary file write: case-insensitive bypass and missing HardLink/SymLink tags

• Path traversal
• CWE-178

<8.30.0 · fixed in 8.30.0

OpenClaw: Windows-compatible env override keys could bypass system.run approval binding

• CWE-41
• CWE-178

<2026.4.2 · fixed in 2026.4.2

prompts.chat Identity Confusion via Case-Sensitive Username Handling

• f prompts.chat
• CWE-178

OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks

• coreruleset
• CWE-178

OpenID Connect / OAuth client - Less critical - Access bypass - SA-CONTRIB-2026-027

• Drupal OpenID Connect / OAuth client
• CWE-178

DataEase is Vulnerable to H2 JDBC RCE Bypass

• dataease
• CWE-178

OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths

• CWE-178
• CWE-625

<2026.3.11 · fixed in 2026.3.11

simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE

• Command injection
• CWE-76

>=3.15.0, <3.32.3 · fixed in 3.32.3

traefik CVE-2024-45410 fix bypass: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`) in github.com/traefik/traefik

• CWE-178

* · no fixed version yet

MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity

• CWE-178
• CWE-436

<1.3.1 · fixed in 1.3.1

Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass

• CWE-178

<2.11.1 · fixed in 2.11.1

Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass

• CWE-178

<2.11.1 · fixed in 2.11.1

File Browser has an Authentication Bypass in User Password Update

• CWE-178

<2.57.1 · fixed in 2.57.1

SiYuan File Read API Case Sensitivity Bypass can Lead to Path Traversal

• Path traversal
• CWE-178

<=0.0.0-20260126094835-d5d10dd41b0c · no fixed version yet

Formio improperly authorized permission elevation through specially crafted request path

• Information disclosure
• CWE-178

<3.5.7 || >=4.0.0-rc.1, <4.4.3 · fixed in 3.5.7, 4.4.3

Cursor IDE: Sensitive File Overwrite Bypass is Possible

• cursor
• CWE-178

Cursor CLI Agent: Sensitive File Overwrite Bypass

• cursor
• Code injection
• CWE-178

elysia-cors Origin Validation Error

• CWE-178
• CWE-346

<1.3.1 · fixed in 1.3.1

Apache Tomcat - CGI security constraint bypass

• CWE-178

>=9.0.0.M1, <9.0.105 || >=10.1.0-M1, <10.1.41 || >=11.0.0-M1, <11.0.7 || >=8.5.0, <=8.5.100 · fixed in 9.0.105, 10.1.41, 11.0.7

Libsoup: cookie domain validation bypass via uppercase characters in libsoup

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-178

Flask-CORS vulnerable to Improper Handling of Case Sensitivity

• CWE-178

<6.0.0 · fixed in 6.0.0

Apache Camel: Camel Message Header Injection via Improper Filtering

• CWE-178

>=3.10.0, <3.22.4 || >=4.0.0-M1, <4.8.5 || >=4.9.0, <4.10.2 · fixed in 3.22.4, 4.8.5, 4.10.2

Improper handling of case sensitivity in Jenkins OpenId Connect Authentication Plugin

• Broken access control
• CWE-178

<4.453.v4d7765c854f4 · fixed in 4.453.v4d7765c854f4

Gradio Blocked Path ACL Bypass Vulnerability

• Broken access control
• CWE-178

<5.11.0 · fixed in 5.11.0

Spring LDAP data exposure vulnerability

• CWE-178

>=3.0.0, <3.2.8 || <2.4.4 · fixed in 3.2.8, 2.4.4

Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation.

• CWE-178
• CWE-289

>=8.0.0, <10.2.11 || >=10.3.0, <10.3.9 || >=11.0.0, <11.0.8 · fixed in 10.2.11, 10.3.9, 11.0.8

Spring Framework DataBinder Case Sensitive Match Exception

• CWE-178

>=6.1.0, <6.1.14 || >=6.0.0, <=6.0.24 || <=5.3.40 · fixed in 6.1.14

Mozilla Firefox: In violation of spec, cookie prefixes such as `__Secure` were being ignored if they were…

• Mozilla Firefox
• CWE-178

social-auth-app-django affected by Improper Handling of Case Sensitivity

• Authentication bypass
• CWE-178

<5.4.1 · fixed in 5.4.1

Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

• Information disclosure
• Broken access control

>=2.7.0, <2.9.17 || >=3.0.0, <3.2.8 || >=4.0.0, <4.5.2 || >=5.0.0, <5.0.12 · fixed in 2.9.17, 3.2.8, 4.5.2, 5.0.12

curl: This flaw allows a malicious HTTP server to set "super cookies" in curl that are then…

• curl
• CWE-178

Chamilo LMS Htaccess File Upload Security Bypass

• Chamilo
• CWE-178

Arbitrary File Overwrite in Eclipse JGit

• Path traversal
• CWE-178

>=6.0.0.202111291000-r, <6.6.1.202309021850-r || <5.13.3.202401111512-r · fixed in 6.6.1.202309021850-r, 5.13.3.202401111512-r

An issue was discovered in ONOS 2.5.1.

• CWE-178

Improper handling of case sensitivity in Spring Framework

• CWE-178

>=5.3.0, <5.3.19 || <5.2.21.RELEASE · fixed in 5.3.19, 5.2.21.RELEASE