CVE-2026-41901: Thymeleaf Cve 2026 41901 Typename Firstchar Shortcut
Detected first-character shortcut in a type-name deny-list check (isTypeBlockedForAllPurposes / isTypeBlockedForTypeReference). The conditional `if (c0 != 'c' && c0 != 'j' && c0 != 'o' && c0 != 's') return false;` (or the 'c'/'n'/'j'/'o' variant) short-circuits the actual deny-list lookup based on the assumption that every blocked package starts with one of
Javagreprules fetch cve-2026-41901-thymeleaf-cve-2026-41901-typename-firstchar-shortcut --engine opengrepDescription
Detected first-character shortcut in a type-name deny-list check (isTypeBlockedForAllPurposes / isTypeBlockedForTypeReference). The conditional `if (c0 != 'c' && c0 != 'j' && c0 != 'o' && c0 != 's') return false;` (or the 'c'/'n'/'j'/'o' variant) short-circuits the actual deny-list lookup based on the assumption that every blocked package starts with one of
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.