GrepRules
Sign inPublish rule
Explore

Rule Explorer

Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.

Public rules
6965
Downloads
12.9M
Verified
6965
Authors
2
Search the rule indexUse CVE, GHSA, CWE, language, framework, package, or rule slug.
1 rules matched. Showing 1 loaded rules.
Publish rule
CVE-2026-114616: Hmac Key Validator Missing Empty Checkcve-2026-114616-hmac-key-validator-missing-empty-check

Key-material validator $CHECK_KEY() rejects malformed key formats (key material containing unsafe PEM/SSH markers) but never rejects empty key material. HMAC with a zero-length key is deterministic and publicly computable, so a secret that resolves to "" or b"" (missing/unset configuration, a JWK {"kty":"oct","k":""}, or a key callable returning "") lets an

PythonCVE-2026-114616CWE-1284CWE-20
by Provallyupdated 2026-10-27Apache-2.0
490 direct49 via packs
87
All matching rules loaded.