CWE-178 Improper Handling of Case Sensitivity

svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences

Backstage: Scaffolder action input authorization bypass

Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound Filtering

Apache Camel has an incomplete fix for CVE-2025-27636

fastify vulnerable to header validation bypass via incomplete schema case normalization

fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass

xmldom: HTML raw-text closing-tag case mismatch causes output amplification

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

JupyterLab: PyPI extension blocklist package-name canonicalization bypass

Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling

Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth

Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

OpenFGA Improper Policy Enforcement

MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence

Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files

Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

SafeInstall agent guard shell parsing can miss raw package execution

Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering

Authelia has an Edge Case Access Control Rule Mismatch

@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapter

Authelia Missing Username Canonicalization in Basic Auth (LDAP)