CWE-178: Improper Handling of Case Sensitivity
The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- ibm api connect Multiple Vulnerabilities in IBM API Connect 9.4 Critical
- ibm api connect Multiple Vulnerabilities in IBM API Connect 4.1 Medium
- sysadminsmedia homebox HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service 6.5 Medium
- hulumi policies Kubewarden trusted-repos-policy: uppercase registry host bypasses registry/image deny rules 6.3 Medium
-
libhttp-body-perlDebian,perl-HTTP-BodyopenSUSE +1 more HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them 9.8 Critical - samba, red hat enterprise linux 10, enterprise linux 6 +5 more +7 more Samba: access control bypass via vfs_ceph_rgw case-insensitive open 8.1 High
- tanium server Tanium addressed an incorrect privilege assignment vulnerability in Tanium Server. 6.6 Medium
- hashicorp consul, consul enterprise +1 more Consul vulnerable to an authorization bypass in service mesh registration 8.8 High
- misp misp-guard MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding 7.1 High
- @clerk nuxt Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive 6.3 Medium
- apache camel Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing 6.5 Medium
- apache camel Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching 8.2 High
- wheels Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case... 3.7 Low
- nodejs undici undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens 5.9 Medium
- wazuh wazuh-manager Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch 8.6 High
- @clerk fastify fastify vulnerable to header validation bypass via case-sensitive propertyNames 3.7 Low
- e2b-dev open-computer-use Open Computer Use through 1.0.0 Denylist Bypass via Case-Variant Bundle ID 5.8 Medium
- darylldoyle svg-sanitizer svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences 6.5 Medium
- docker sandboxes Docker Sandboxes OAuth response masking could be bypassed with a case-variant token host 6.7 Medium
- hashicorp vault, vault enterprise +1 more Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions 7.2 High
- @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 more Backstage: Scaffolder action input authorization bypass 8.1 High
- @backstage plugin-catalog-backend, backstage, linuxfoundation backstage plugin-catalog-backend +2 more Backstage: Inconsistent catalog property permission evaluation 4.3 Medium
- owasp-modsecurity modsecurity ModSecurity: Response Body Inspection Bypass 8.6 High
- accellion kiteworks, kiteworks email protection gateway +1 more Kiteworks Email Protection Gateway Improper Handling of Case Sensitivity 7.2 High
- getgrav grav Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass 8.7 High
- openclaw OpenClaw before 2026.7.1 Remote Code Execution via cron tool 8.7 High
- openclaw matrix OpenClaw Matrix before 2026.8.1 Authorization Bypass via Case Folding 7.7 High
-
jetty12Debian,jetty9Debian,org.eclipse.jetty:apache-jspTuxCare +126 more +128 more Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames 8.8 High - steveiliop56 tinyauth Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for 8.1 High
- caddyserver caddy Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation 6.3 Medium
- caddyserver caddy Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS 6.9 Medium
- caddyserver caddy Caddy: rewrite placeholder re-expansion 6.5 Medium
- @fastify/static @fastify/static vulnerable to route guard bypass via path case-folding 5.3 Medium
- fast-uri fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets 4.8 Medium
- dolibarr Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter 7.1 High
- gohugo hugo Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass 8.6 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 more Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up) 3.0 Low
- grokability snipe-it Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation 8.6 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 more Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup 9.2 Critical
- @clerk fastify fastify vulnerable to header validation bypass via incomplete schema case normalization 7.5 High
- grpc grpc-go gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion 6.3 Medium
- erlang otp httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems 8.2 High
- @xmldom xmldom xmldom: HTML raw-text closing-tag case mismatch causes output amplification 8.7 High
- ash-project ash phoenix AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant 6.3 Medium
- google chrome Improper handling of case sensitivity in FileSystem in Google Chrome prior to 152.0.7977.65... 6.5 Medium
- cloud foundry uaa, cf-deployment +1 more Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise 8.7 High
- filebrowser FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass 9.2 Critical
- drupal external authentication, external authentication project authentication +1 more External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098 5.4 Medium
- discourse Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison 5.3 Medium
- @clerk nuxt Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721) 8.2 High
- Show olderLoading…