Lucene search
+L

1 matches found

OSV
OSV
added 2026/02/24 8:39 p.m.8 views

GHSA-5R3V-VC8M-M96G Caddy: Unicode case-folding length expansion causes incorrect split_path index in FastCGI transport

Summary Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because strings.ToLower can change UTF-8 byte length for some characters. As a result, Caddy can deri...

9.3CVSS6.6AI score0.00542EPSS
SaveExploits1References6
Rows per page
Query Builder