Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
added 2026/02/24 8:39 p.m.7 views

Caddy: Unicode case-folding length expansion causes incorrect split_path index in FastCGI transport

Summary Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because strings.ToLower can change UTF-8 byte length for some characters. As a result, Caddy can deri...

9.8CVSS6.5AI score0.00542EPSS
SaveExploits1References6Affected Software1
Rows per page
Query Builder