CVE-2026-41901: Thymeleaf Cve 2026 41901 Typename Firstchar Shortcutcve-2026-41901-thymeleaf-cve-2026-41901-typename-firstchar-shortcut
Detected first-character shortcut in a type-name deny-list check (isTypeBlockedForAllPurposes / isTypeBlockedForTypeReference). The conditional `if (c0 != 'c' && c0 != 'j' && c0 != 'o' && c0 != 's') return false;` (or the 'c'/'n'/'j'/'o' variant) short-circuits the actual deny-list lookup based on the assumption that every blocked package starts with one of
