Weaknesses of type CWE-178

87 results

Tratamento inadequado de sensibilidade a maiúsculas/minúsculas

O código não trata corretamente a diferença entre letras maiúsculas e minúsculas em validações, comparações ou operações de segurança. Um atacante pode contornar filtros ou controles de acesso usando variações de caso (exemplo: 'Admin' em vez de 'admin'), já que a aplicação não normaliza ou compara corretamente as strings.

Example

Um sistema valida nomes de arquivo para bloquear '.exe', mas aceita '.EXE' ou '.Exe' porque a verificação é case-sensitive. Ou um WAF bloqueia a palavra-chave 'union' em SQL, mas o atacante injeta 'UnIoN' e consegue contornar o filtro.

How to mitigate

Normalize sempre para um único case (tipicamente minúsculas) antes de comparar strings em contextos de segurança. Use funções de comparação case-insensitive ou converta explicitamente com toLowerCase()/toUpperCase() antes de validações, filtros e controles de acesso.

CVE-2026-22665HIGHprompts.chat Identity Confusion via Case-Sensitive Username HandlingEPSS 0.3%CVE-2026-86770HIGHSnipe-IT before 8.7.0 Authentication Bypass via SAML Username CollationEPSS 0.3%CVE-2026-15573HIGHKeycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcherEPSS 0.3%CVE-2025-67718HIGHFormio improperly authorized permission elevation through specially crafted request pathEPSS 0.3%CVE-2026-84303MEDIUMgRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasionEPSS 0.3%CVE-2026-59335HIGHCase-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA CompromiseEPSS 0.3%CVE-2026-42273HIGHHeimdall: Case-sensitive host matching may lead to policy bypassEPSS 0.3%CVE-2026-82726MEDIUMAshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenantEPSS 0.3%CVE-2026-83612HIGHxmldom: HTML raw-text closing-tag case mismatch causes output amplificationEPSS 0.3%CVE-2026-84428HIGHfastify vulnerable to header validation bypass via incomplete schema case normalizationEPSS 0.3%CVE-2026-66883MEDIUMOidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookupEPSS 0.3%CVE-2026-8404LOWPotential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddlewareEPSS 0.3%CVE-2026-82067CRITICALImproper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at StartupEPSS 0.3%CVE-2026-71315HIGHNuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)EPSS 0.3%CVE-2026-27896HIGHMCP Go SDK Vulnerable to Improper Handling of Case SensitivityEPSS 0.3%CVE-2026-47346HIGHTYPO3 CMS - Broken Access Control in Form FrameworkEPSS 0.3%CVE-2026-70429HIGHJenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackeEPSS 0.2%CVE-2026-44367LOWKlaw: user lockout due to case sensitivity inconsistencyEPSS 0.2%CVE-2026-46392HIGHHAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload ValidationEPSS 0.2%CVE-2026-54763HIGHTraefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuthEPSS 0.2%