Falhas do tipo CWE-178

117 resultados

Tratamento inadequado de sensibilidade a maiúsculas/minúsculas

Ocorre quando o código não trata corretamente diferenças entre maiúsculas e minúsculas em strings, permitindo que um atacante contorne validações, filtros de segurança ou lógica de autorização. Por exemplo, se um firewall bloqueia 'admin.php' mas aceita 'ADMIN.PHP', a proteção é burlada.

Exemplo

Uma aplicação valida extensões bloqueadas comparando contra lista em minúsculas (.exe, .bat), mas o usuário faz upload de 'arquivo.EXE' ou 'arquivo.ExE' que passa pela validação por falta de normalização da entrada antes da comparação.

Como mitigar

Normalize todas as strings para um padrão único (toLowerCase() ou toUpperCase()) antes de qualquer comparação de segurança. Sempre considere o contexto do sistema operacional ou banco de dados — Windows ignora case em caminhos, mas Linux não — e aplique as mesmas regras que o ambiente subjacente usa.

CVE-2026-105608HIGHConsul vulnerable to an authorization bypass in service mesh registrationEPSS 0.5%CVE-2025-4035MEDIUMLibsoup: cookie domain validation bypass via uppercase characters in libsoupEPSS 0.4%CVE-2026-100669HIGHGrav before 2.0.25 Sensitive File Disclosure via Case-Variation BypassEPSS 0.4%CVE-2026-15617CRITICALPrincipal/domain lookup without case normalizationEPSS 0.4%CVE-2026-27588HIGHCaddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypassEPSS 0.4%CVE-2026-27587HIGHCaddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypassEPSS 0.4%CVE-2026-114132MEDIUMNuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitiveEPSS 0.4%CVE-2025-61593HIGHCursor CLI Agent: Sensitive File Overwrite BypassEPSS 0.4%CVE-2026-70429HIGHJenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackeEPSS 0.4%CVE-2026-48794LOWAuthelia has an Edge Case Access Control Rule MismatchEPSS 0.4%CVE-2024-55634HIGHDrupal core - Moderately critical - Access bypass - SA-CORE-2024-004EPSS 0.4%CVE-2026-92700MEDIUMCaddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variationEPSS 0.4%CVE-2026-54528HIGHjupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded DirectoriesEPSS 0.4%CVE-2026-53721HIGHNuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcherEPSS 0.4%CVE-2026-42272HIGHHeimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretationEPSS 0.4%CVE-2026-62230HIGHGrav < 2.0.4 File Access Bypass via Case VariationEPSS 0.4%CVE-2026-14617LOWNousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivityEPSS 0.4%CVE-2024-38829LOWSpring LDAP sensitive data exposure for case-sensitive comparisonsEPSS 0.4%CVE-2026-116469HIGHMISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data ForwardingEPSS 0.4%CVE-2026-78959MEDIUMImproper handling of case sensitivity in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engiEPSS 0.4%