CWE-178: Improper Handling of Case Sensitivity
The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- jenkinsJenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and...6.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +7 more +9 moreKeycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher8.1 High
- erlang ecosystem foundation oidcc plugOidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup6.3 Medium
- logtoPrincipal/domain lookup without case normalization9.1 Critical
- jupyterlabjupyterlab: PyPI extension blocklist package-name canonicalization bypass6.1 Medium
- freescout-help-desk freescoutFreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL9.4 Critical
- jugmac00 flask-reuploadedFlask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)7.5 High
- getgrav gravGrav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems8.2 High
- getgrav gravGrav < 2.0.4 File Access Bypass via Case Variation8.7 High
safeinstall-clinpmSafeInstall agent guard shell parsing can miss raw package execution8.8 High- traefikTraefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth7.8 High
- nousresearch hermes-agentNousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivity2.3 Low
- flowiseFlowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity2.3 Low
- gogsGogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion7.1 High
- gogsIn Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a...7.1 High
- quarkus, red hat cryostat 4 on rhel 9, openshift serverless +15 more +17 moreAuthentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities7.5 High
- autheliaAuthelia has an Edge Case Access Control Rule Mismatch1.3 Low
- jupyter jupyterlab-gitjupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories7.1 High
- microsoft kiota-typescript@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapter5.5 Medium
- nokogiriNokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-262472.6 Low
- openfga, openfga helm charts +1 moreOpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions2.1 Low
- bitbonsai mcpvaultMCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence8.4 High
- @clerk nuxtNuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher8.8 High
- typo3 cmsTYPO3 CMS - Broken Access Control in Form Framework7.6 High
- haxtheweb haxcms-phpHAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation8.7 High
- djangoproject djangoPotential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware2.3 Low
- elixir-tesla teslaAuthorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects8.2 High
- aiven-open klawKlaw: user lockout due to case sensitivity inconsistency2.7 Low
- autheliaAuthelia Missing Username Canonicalization in Basic Auth (LDAP)2.9 Low
- theupdateframework python-tufpython-tuf: Platform-dependent delegation path matching4.0 Medium
github.com/envoyproxy/ai-gatewayGoEnvoy AI Proxy - MCP Message Smuggling Vulnerability6.3 Medium- apache camel, red hat openshift serverless, build of apache camel 4 for quarkus 3 +4 more +6 moreApache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering9.8 Critical
- caddyserver caddyCaddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files8.1 High
- php frankenphpFrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files8.1 High
- apache tomcatApache Tomcat: LockOutRealm treats user names as case-sensitive7.5 High
- gnu gnutls, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +31 more +33 moreGnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison6.5 Medium
- apache camel, apache software foundation camel coap, camel google pubsub +10 more +12 moreApache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows ca…9.9 Critical
- dadrus heimdallHeimdall: Case-sensitive host matching may lead to policy bypass7.8 High
- dadrus heimdallHeimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation7.8 High
- emilstenstrom justhtmljusthtml before 1.16.0 Multiple Security Issues via Sanitization9.3 Critical
- emilstenstrom justhtmljusthtml before 1.15.0 Multiple Security Issues9.3 Critical
github.com/gotenberg/gotenberg/v7Go,github.com/gotenberg/gotenberg/v8Go +1 moreGotenberg has incomplete fix for ExifTool arbitrary file write: case-insensitive bypass and missing HardLink/SymLink tags8.8 High- f prompts.chatprompts.chat Identity Confusion via Case-Sensitive Username Handling8.6 High
- coreruleset, owasp modsecurity core rule set +1 moreOWASP CRS: Whitespace padding in filenames bypasses file upload extension checks6.8 Medium
- openclawOpenClaw < 2026.3.22 - Remote File URL Acceptance in Windows Media Loaders6.9 Medium
- openclawOpenClaw - Approval Bypass via Environment Variable Normalization6.9 Medium
- dataeaseDataEase is Vulnerable to H2 JDBC RCE Bypass7.7 High
- openclawOpenClaw < 2026.3.11 - Exec Allowlist Pattern Overmatch via POSIX Path Normalization8.8 High
- simple-git project simple-git, red hat logging subsystem for red hat openshift, enterprise linux 8 +4 more +6 moresimple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE9.8 Critical
- traefik, red hat openshift dev spaces 3.27 +1 moreTraefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)7.5 High
- Show moreLoading…