Gotenberg <= 8.30.1 - Server Side Request Forgery

Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression ^https?:// to match URL schemes. Because Go's net/url.Parse normalizes...

CVE-2026-85254

A flaw was found in Apache Camel's Platform HTTP component. The mechanism designed to prevent request headers from being reflected into HTTP responses improperly compares header names using case-sensitive checks. A remote attacker can exploit this behavior by varying header name casing or sending...

CVE-2020-14882

CVE-2020–14882 Weblogic Unauthorized bypass RCE bypass patch with CVE-2020–14882 private static final String IllegalUrl = new String";", "%252E%252E", "%2E%2E", "..", "%3C", "%3E", ""; list %252E%252E %2E%2E .. %3E %3C ; lower "%252E%252E%252F".lower '%252e%252e%252f' %252E%252E%252F to...

CVE-2026-5556-Kubernetes-Admission-Controller-Bypass-via-Case-Sensitivity

CVE-2026-5556 – Kubernetes Admission Controller Bypass via Case Sensitivity Program Code Python admission webhook + exploit !/usr/bin/env python3 admissionwebhook.py - Vulnerable webhook that rejects pods with specific name from flask import Flask, request, jsonify app = Flaskname DENIEDPODNAMES ...

CVE-2025-27636-Practical-Lab

🛡️ CVE-2025-27636 — Practical Exploitation Lab for Apache Camel 🔍 Overview CVE-2025-27636 is a critical Remote Code Execution RCE vulnerability in Apache Camel , specifically in the camel-exec component. It stems from a subtle but dangerous issue: TheDefaultHeaderFilterStrategy performs...

cve-2024-32002-poc-rce

CVE-2024-32002 RCE POC A POC for CVE-2024-32002 demonstrating Remote Code Execution RCE. See cve-2024-32002-poc-rce for the related submodule repository. What this repo contains A symlink with an arbitraty name that links to the .git directory. A .gitmodules file that defines the malicious...

cve-2024-32002-poc-aw

CVE-2024-32002 PRC AW A POC for CVE-2024-32002 demonstrating arbitrary write into the .git directory. See cve-2024-32002-submodule-aw for the related submodule repository. What this repo contains A symlink with an arbitraty name that links to the .git directory. A .gitmodules file that defines th...

PT-2026-134233

Name of the Vulnerable Software and Affected Versions Kubewarden policies versions prior to 2.1.2 Description The trusted-repos-policy performs case-sensitive comparisons of an image's registry hostname against reject and allow lists, despite DNS names being case-insensitive. This allows a bypass...

MISP Project misp-guard input validation error vulnerability

Versions 1.3 and earlier of the MISP Project’s misp-guard contain an input validation error vulnerability. This flaw arises from multiple policy execution checks that perform case-sensitive string comparisons on event tags, attribute categories, and shared group UUIDs. Attackers can exploit this ...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via case-sensitive matching of server-side route rules, where route rule protections such as redirect, headers, and proxy rules can be bypassed by an attacker who sends a request path with differing letter case...

npm: fastify is vulnerable to header validation bypass via case-sensitive propertyNames

npm: fastify is vulnerable to header validation bypass via case-sensitive propertyNames vulnerability discovered by ? in WordPress npm fastify versions = 5.12.2, 5.12.6...

CVE-2026-80343 Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching

Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-netty-http security constraint compared the request path against the configured context path using a...

CVE-2026-80343 Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching

Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-netty-http security constraint compared the request path against the configured context path using a...

CVE-2026-80343 Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching

Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-netty-http security constraint compared the request path against the configured context path using a...

CVE-2026-80343

The camel-netty-http component in Apache Camel is vulnerable to a security constraint bypass due to improper handling of case sensitivity (CWE-178 ). The vulnerability exists because the security constraint uses a case-sensitive match against the configured context path, while the request dispatc...

WS-2026-0167

istio 1.2.0-rc.0 - 1.28.10 all EOL lines, no fix, 1.29.0-alpha.0 - 1.29.8, 1.30.0-alpha.1 - 1.30.5, 1.31.0-alpha.0 - 1.31.1, 1.32.0-alpha.0: AuthorizationPolicy methods/notMethods rules compile to a case-sensitive :method matcher, so an HTTP/2 request with a different-case method bypasses DENY or...

Linux Distros Unpatched Vulnerability : CVE-2026-18660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that...

DEBIAN-CVE-2026-18660

In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case...

CVE-2026-18660

In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case...

CVE-2026-18660 Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames

In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case...