Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
•added 2026/02/24 8:39 p.m.•15 views

Caddy: Unicode case-folding length expansion causes incorrect split_path index in FastCGI transport

Summary Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because strings.ToLower can change UTF-8 byte length for some characters. As a result, Caddy can deri...

9.8CVSS8.2AI score0.0086EPSS
SaveExploits1References6Affected Software1
Rows per page
Query Builder