Weaknesses of type CWE-178

87 results

Tratamento inadequado de sensibilidade a maiúsculas/minúsculas

O código não trata corretamente a diferença entre letras maiúsculas e minúsculas em validações, comparações ou operações de segurança. Um atacante pode contornar filtros ou controles de acesso usando variações de caso (exemplo: 'Admin' em vez de 'admin'), já que a aplicação não normaliza ou compara corretamente as strings.

Example

Um sistema valida nomes de arquivo para bloquear '.exe', mas aceita '.EXE' ou '.Exe' porque a verificação é case-sensitive. Ou um WAF bloqueia a palavra-chave 'union' em SQL, mas o atacante injeta 'UnIoN' e consegue contornar o filtro.

How to mitigate

Normalize sempre para um único case (tipicamente minúsculas) antes de comparar strings em contextos de segurança. Use funções de comparação case-insensitive ou converta explicitamente com toLowerCase()/toUpperCase() antes de validações, filtros e controles de acesso.

CVE-2024-6866MEDIUMCase-Insensitive Path Matching in corydolphin/flask-corsEPSS 0.7%CVE-2026-45135HIGHCaddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP FilesEPSS 0.7%CVE-2026-73270HIGHhttpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystemsEPSS 0.7%CVE-2024-38820LOWCVE-2024-38820: Spring Framework DataBinder Case Sensitive Match ExceptionEPSS 0.6%CVE-2026-54567HIGHFlask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)EPSS 0.6%CVE-2024-32879MEDIUMsocial-auth-app-django Improper Handling of Case Sensitivity vulnerabilityEPSS 0.6%CVE-2026-45062HIGHFrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP FilesEPSS 0.6%CVE-2026-3833MEDIUMGnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparisonEPSS 0.6%CVE-2026-43513HIGHApache Tomcat: LockOutRealm treats user names as case-sensitiveEPSS 0.5%CVE-2026-62673HIGHGrav: .htaccess file extension rules bypass via case variation on case-insensitive filesystemsEPSS 0.5%CVE-2026-48595HIGHAuthorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirectsEPSS 0.5%CVE-2026-73416MEDIUMjupyterlab: PyPI extension blocklist package-name canonicalization bypassEPSS 0.5%CVE-2026-62230HIGHGrav < 2.0.4 File Access Bypass via Case VariationEPSS 0.5%CVE-2025-50864MEDIUMAn Origin Validation Error in the elysia-cors library thru 1.3.0 allows attackers to bypass Cross-Origin Resource Sharing (CORS) restrictionEPSS 0.5%CVE-2026-29054HIGHTraefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)EPSS 0.5%CVE-2026-47203LOWAuthelia Missing Username Canonicalization in Basic Auth (LDAP)EPSS 0.5%CVE-2026-32939HIGHDataEase is Vulnerable to H2 JDBC RCE BypassEPSS 0.4%CVE-2026-72721MEDIUMDiscourse: Onebox Domain Blocklist Bypass via Case-Sensitive ComparisonEPSS 0.4%CVE-2025-4035MEDIUMLibsoup: cookie domain validation bypass via uppercase characters in libsoupEPSS 0.4%CVE-2026-48794LOWAuthelia has an Edge Case Access Control Rule MismatchEPSS 0.4%