CVE-2026-75627: Raw Request Uri Auth Checkcve-2026-75627-raw-request-uri-auth-check
Access control decisions or path checks should not use `HttpServletRequest.getRequestURI()` with substring or prefix matching methods like `contains()`, `startsWith()`, or `endsWith()`. Raw request URIs may include matrix parameters, path traversal tokens, or unnormalized prefixes that allow authentication and authorization bypass. Use container-normalized m
