CuraSec

tag: Vulnerability-Class · 2 items

Learn Python str.lower() as a security vulnerability via Unicode folding
2026-08-26 · HN (security) · source ↗ #python#appsec#vulnerability-class
  • Engineer — Learn: Highlights how Unicode case-folding edge cases in str.lower() can silently break security-sensitive comparisons (e.g., allowlist checks, hostname validation). No active exploitation or CVE, but worth auditing any Python code that uses case normalization for access control or identity checks.
  • SOC/IR — Skip
  • Leader — Skip
Learn archived Canonicalization Failures Systematized Across Cryptographic Ecosystems
2026-08-10 · arXiv cs.CR · source ↗ #cryptography#vulnerability-class#secure-design
  • Engineer — Learn: This paper provides a cross-ecosystem taxonomy of canonicalization failures (transaction malleability, hash-chain malleability, etc.) and a practical review procedure for identifying this class of defect in cryptographic code. Worth reading before designing or auditing any system where a hash, signature, or replay-protection scheme depends on serialized representations.
  • SOC/IR — Skip
  • Leader — Skip