CVE-2026-48794: Case Sensitive Domain Match
Using case-sensitive string matching (e.g., `strings.HasSuffix`) to validate domains or hostnames can lead to access control bypasses. Attackers might exploit upper/lower case variations (e.g., `a.B.example.com`) to avoid specific rules. Ensure domain validation is case-insensitive, for example by converting to lowercase before comparison, or using case-inse
Gogreprules fetch cve-2026-48794-case-sensitive-domain-match --engine opengrepDescription
Using case-sensitive string matching (e.g., `strings.HasSuffix`) to validate domains or hostnames can lead to access control bypasses. Attackers might exploit upper/lower case variations (e.g., `a.B.example.com`) to avoid specific rules. Ensure domain validation is case-insensitive, for example by converting to lowercase before comparison, or using case-inse
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.