CVE-2026-27482: Incomplete Http Method Blocklist
Using a blocklist of HTTP methods (e.g., explicitly matching POST or PUT) to deny requests is prone to omissions. Methods like DELETE or PATCH may be inadvertently allowed, leading to CSRF or unintended modifications from untrusted origins. Use an allowlist of safe methods (e.g., GET, HEAD, OPTIONS) and deny all others instead.
Pythongreprules fetch cve-2026-27482-incomplete-http-method-blocklist --engine opengrepDescription
Using a blocklist of HTTP methods (e.g., explicitly matching POST or PUT) to deny requests is prone to omissions. Methods like DELETE or PATCH may be inadvertently allowed, leading to CSRF or unintended modifications from untrusted origins. Use an allowlist of safe methods (e.g., GET, HEAD, OPTIONS) and deny all others instead.
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.