CVE-2026-17409 affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The vulnerability arises from improper handling of case sensitivity in access controls, allowing a remote attacker to bypass restrictions and execute unauthorized administrative operations or access sensitive information.
CVE-2026-17085 affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The vulnerability arises from improper handling of case sensitivity in access restrictions, which allows a remote authenticated attacker to bypass security controls and send unauthorized emails. The flaw does not impact confidentiality or availability but can lead to limited integrity violations. The CVSS score is 4.1, indicating medium severity.
HomeBox versions prior to 0.27.0 have a vulnerability where email addresses are treated as case-sensitive during user registration but case-insensitive during login. This discrepancy allows an unauthenticated attacker to register an email address variant with different casing, bypassing the one-account-per-email policy and causing login failures for both variants, effectively denying access to the legitimate user. The issue is resolved in version 0.27.0.
ModSecurity versions from 3.0.0 up to but not including 3.0.17 improperly handle case sensitivity when comparing response Content-Type headers against configured SecResponseBodyMimeType entries. This flaw allows a mixed-case response media type, semantically equivalent to a configured lowercase type, to bypass response body inspection. As a result, an unauthenticated attacker can receive response content that would normally be blocked by phase 4 rules, potentially exposing sensitive error or debug information. The issue is resolved in version 3.0.17.
In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different vulnerability than CVE-2026-52810. This occurs because of a case-sensitivity desync between the authorization classifier and the request dispatcher: the gitHTTPIsPull function compares the Git action verb case-sensitively and defaults to pull (read access) for any unrecognized string, whereas the request dispatcher lowercases the same verb before routing it to the receive-pack handler. Capitalizing a single letter in the URL (e.g. info/Refs instead of info/refs, or git-receive-Pack instead of git-receive-pack) causes the classifier to misidentify a push as a pull, granting only read-level authorization, whereas the dispatcher routes it to the write handler. An authenticated read-only collaborator can exploit this to push to a private repository, creating, updating, or deleting refs.
Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions provisionally classified as affected before 2.1.2, `trusted-repos-policy` compares an image's `registry` hostname against `reject lists` and `allow lists` case-sensitively even though `registry` DNS names are case-insensitive. An image with an uppercase or mixed-case `registry` hostname can miss a rejection rule for the equivalent lowercase host, so the admission policy accepts a resource whose container runtime pulls the same prohibited image. Only reject-list configurations have this bypass: allow-list configurations fail closed by over-denying differently cased hostnames. The security consequences depend on the configured rejection policy and deployment environment. This issue is fixed in version 2.1.2.
CVE-2026-116135 is a critical vulnerability in HTTP::Body versions before 1.23_01 for Perl. The issue arises from improper handling of case sensitivity in percent-encoded sequences within URL-encoded form fields. Mixed-case percent escapes such as %aB are dropped instead of decoded, causing the application to receive altered input values. This can lead to discrepancies between what a conforming decoder interprets and what the vulnerable HTTP::Body module processes.
HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability (CVE-2026-105608) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.
MISP Guard, a proxy-based security filter for MISP feed distribution, has a case-sensitivity flaw in multiple policy enforcement checks. This flaw allows attackers with event creation privileges to bypass configured security policies by altering the letter case of taxonomy tags, attribute categories, or sharing-group UUIDs. As a result, unauthorized threat intelligence data may be disclosed to downstream feed consumers, violating confidentiality controls.
Nuxt versions prior to 4.6.2 have a case sensitivity mismatch between page resolution and server-side route-rule matching. This allows requests with paths differing only by letter case to bypass intended server rules such as redirects, headers, proxy settings, and SSR controls. Applications that set router.options.sensitive: true in nuxt.config are not affected. The issue is fixed in version 4.6.2.
Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
The guard that prevents a request header being reflected into the response compared header names case sensitively, while HTTP header names are case insensitive. A caller could therefore defeat the suppression simply by varying the case of the header name. HTTP/2 makes the problem unconditional rather than optional: the protocol requires header names to be lowercase on the wire, so the comparison never matched and the suppression was inert for every request on an HTTP/2 connection. The consequence is that content the caller chose is echoed back in the response, which is the basis for response-splitting and cache-poisoning style attacks against whatever sits in front of the Camel endpoint.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Request header names are now compared case insensitively, so the suppression holds regardless of casing and works under HTTP/2. For deployments that cannot upgrade immediately, strip the headers in question in front of the Camel endpoint, or remove them from the response in the route rather than relying on the built-in suppression.
CVE-2026-80343 is a high-severity vulnerability in Apache Camel's Netty HTTP component affecting versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. The issue arises from inconsistent case sensitivity handling between the security constraint and request routing, allowing an attacker to bypass security constraints by altering the case of characters in the request path. This bypass enables access to protected routes without credentials or special configuration. Fixed versions are 4.18.5 and 4.22.1, which align case sensitivity rules between the constraint and routing. Until upgrading, users should place authorization checks before the Camel consumer, such as in a reverse proxy that normalizes request paths.
CVE-2026-18660 is a high-severity vulnerability in Eclipse Jetty's jetty-server and jetty-proxy components where the host whitelist/blacklist filtering is case-sensitive. This allows hosts that differ only by case to bypass the intended restrictions.
A case sensitivity handling flaw in darylldoyle svg-sanitizer versions prior to 1.0.0 allows an attacker to bypass useNestingLimit protection by exploiting inconsistent href attribute normalization. This can lead to resource exhaustion when rendering sanitized SVGs. The issue is fixed in version 1.0.0.
CVE-2026-105570 is a medium severity vulnerability in Docker Sandboxes involving improper handling of case sensitivity. The issue arises because OAuth token-endpoint hostnames were compared case-sensitively, while DNS routing is case-insensitive. This discrepancy allowed untrusted sandbox code to bypass response masking by using case-variant hostnames, potentially exposing unmasked OAuth access and refresh tokens if the OAuth flow completed.
HashiCorp Vault and Vault Enterprise versions prior to 2.1.2 (Community Edition) and certain 1.x Enterprise versions improperly handle case sensitivity when evaluating ACL policies. This flaw allows authenticated users with delegated permissions to bypass explicit deny restrictions, potentially accessing protected resources or assigning denied policies, leading to privilege escalation. The vulnerability is fixed in Vault Community Edition 2.1.2 and Enterprise versions 2.1.2, 1.21.12, 1.20.17, and 1.19.23.
CVE-2026-102131 is a high-severity vulnerability in Kiteworks Email Protection Gateway that allows an authenticated administrator to bypass input validation and execute arbitrary code. The gateway improperly controls code generation by failing to recognize all forms of certain configuration settings, enabling code injection. This can lead to execution of attacker-controlled files with the gateway service account privileges.
CVE-2026-92700 is a medium severity vulnerability in caddyserver caddy versions 2.11.3 and earlier. It involves improper handling of case sensitivity in the file hiding logic, allowing files intended to be hidden to be exposed on case-insensitive filesystems or when mixed-case paths coexist. This occurs because the fileHidden() function uses case-sensitive filepath.Match checks.
Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cased hostname. The lookup in internal/service/access_controls_service.go through lookupStaticACLs and GetAccessControls, and the Docker-label fallback in internal/service/docker_service.go through GetLabels, can miss the configured app and return an empty access-control object. internal/controller/proxy_controller.go proxyHandler then treats the empty user, group, OAuth, LDAP, and IP restrictions as permissive and returns an authenticated result for an app that should exclude the user. Unauthenticated users remain subject to login, and global login-time allowlists are not bypassed. This issue is fixed in version 5.1.2.
CVE-2026-77281 is a medium severity vulnerability in caddyserver caddy versions prior to 2.11.4. It involves improper control of code generation (code injection) in the rewrite handler and placeholder layer. Specifically, when a rewrite URI ends with a literal question mark, attacker-controlled replacement bytes can be passed through a second placeholder expansion, potentially disclosing environment or request-variable data and readable files if the file provider module is registered. This issue is fixed in version 2.11.4.