CVE-2026-103059

A flaw in Gitea allows an authentication bypass when the built-in SSH server is enabled (START_SSH_SERVER = true). The root cause is the use of an SQL LIKE comparison for looking up public keys, which is case-insensitive on certain databases like SQLite . An attacker who can construct a case vari...

CVE-2026-103059 Gitea built-in SSH server authentication bypass through key case folding

When Gitea's built-in SSH server is enabled STARTSSHSERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...

CVE-2026-100541

OpenClaw's Matrix integration npm package @openclaw/matrix versions = 2026.2.2 and 2026.8.1 lowercase complete Matrix user IDs — including historical localparts and the case-sensitive server-name portion — when deriving the OpenClaw authorization identity. As a result, distinct authenticated Matr...

CVE-2026-100541 OpenClaw Matrix before 2026.8.1 Authorization Bypass via Case Folding

OpenClaw's Matrix integration npm package @openclaw/matrix versions = 2026.2.2 and 2026.8.1 lowercase complete Matrix user IDs — including historical localparts and the case-sensitive server-name portion — when deriving the OpenClaw authorization identity. As a result, distinct authenticated Matr...

CVE-2026-100541 OpenClaw Matrix before 2026.8.1 Authorization Bypass via Case Folding

OpenClaw's Matrix integration npm package @openclaw/matrix versions = 2026.2.2 and 2026.8.1 lowercase complete Matrix user IDs — including historical localparts and the case-sensitive server-name portion — when deriving the OpenClaw authorization identity. As a result, distinct authenticated Matr...

CVE-2026-100541 OpenClaw Matrix before 2026.8.1 Authorization Bypass via Case Folding

OpenClaw's Matrix integration npm package @openclaw/matrix versions = 2026.2.2 and 2026.8.1 lowercase complete Matrix user IDs — including historical localparts and the case-sensitive server-name portion — when deriving the OpenClaw authorization identity. As a result, distinct authenticated Matr...

CVE-2026-90982

CVE-2026-90982 affects the @fastify/static plugin (versions before 10.1.4 ). On case-insensitive filesystems such as Windows or the default macOS volume, a mismatch between the case-sensitive route matcher and the case-insensitive filesystem allows an unauthenticated attacker to bypass route guar...

CVE-2026-90982 @fastify/static vulnerable to route guard bypass via path case-folding

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path...

CVE-2026-90982 @fastify/static vulnerable to route guard bypass via path case-folding

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path...

CVE-2026-90982 @fastify/static vulnerable to route guard bypass via path case-folding

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path...

DEBIAN-CVE-2026-86472

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decod...

CVE-2026-86472

fast-uri is a dependency-free RFC 3986 URI parser for Node.js used by Fastify and ajv . In versions before 2.4.7, 3.0.0–3.1.7, and 4.0.0–4.1.4, the library folds the host to lowercase before percent-decoding, so a percent-encoded uppercase octet (e.g. %41 → A) is never folded. For scheme-relative...

CVE-2026-54567 Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.savestorage, name=... in src/flaskuploads/flaskuploads.py applies lowercaseext to the default upload path but uses the case-preserving extension helper for a caller-supplied name before extensionallowed evaluates ...

CVE-2026-54567

Flask-Reuploaded versions from 1.5.0 to before 1.6.0 are affected by a case-folding asymmetry in the name-override path of UploadSet.save(). When a caller supplies a name override, the extension re-validation uses the case-preserving extension() helper instead of the case-normalizing lowercase_ex...

CVE-2026-54567 Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.savestorage, name=... in src/flaskuploads/flaskuploads.py applies lowercaseext to the default upload path but uses the case-preserving extension helper for a caller-supplied name before extensionallowed evaluates ...

CVE-2026-54567 Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.savestorage, name=... in src/flaskuploads/flaskuploads.py applies lowercaseext to the default upload path but uses the case-preserving extension helper for a caller-supplied name before extensionallowed evaluates ...

CVE-2026-82736 Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass

Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints. Ash.Type.CiString.applyconstraints/2 lib/ash/type/cistring.ex validated the maxlength, minlength, and match...

CVE-2026-82736

ash-project ash (Elixir web framework) contains an Incorrect Behavior Order: Validate Before Canonicalize vulnerability in Ash.Type.CiString.apply_constraints/2 (lib/ash/type/ci_string.ex). The max_length , min_length , and match constraints were validated against the value as submitted , while t...

EUVD-2026-68963

Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints. Ash.Type.CiString.applyconstraints/2 lib/ash/type/cistring.ex validated the maxlength, minlength, and match...

CVE-2026-82736 Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass

Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints. Ash.Type.CiString.applyconstraints/2 lib/ash/type/cistring.ex validated the maxlength, minlength, and match...