https://curasec.metacog.co.kr/tags/vulnerability-class/Recent content in Vulnerability-Class on CuraSecHugoen-usWed, 26 Aug 2026 11:42:13 +0000https://curasec.metacog.co.kr/insights/2026-08-26-when-str-lower-is-a-security-vulnerability-in-python/Wed, 26 Aug 2026 11:42:13 +0000https://curasec.metacog.co.kr/insights/2026-08-26-when-str-lower-is-a-security-vulnerability-in-python/<ul> <li><strong>Engineer — Learn:</strong> Highlights how Unicode case-folding edge cases in str.lower() can silently break security-sensitive comparisons (e.g., allowlist checks, hostname validation). No active exploitation or CVE, but worth auditing any Python code that uses case normalization for access control or identity checks.</li> <li><strong>SOC/IR — Skip</strong></li> <li><strong>Leader — Skip</strong></li> </ul>https://curasec.metacog.co.kr/insights/2026-08-10-canonicalization-failures-as-a-recurring-vulnerability-class/Mon, 10 Aug 2026 13:39:41 +0000https://curasec.metacog.co.kr/insights/2026-08-10-canonicalization-failures-as-a-recurring-vulnerability-class/<ul> <li><strong>Engineer — Learn:</strong> This paper provides a cross-ecosystem taxonomy of canonicalization failures (transaction malleability, hash-chain malleability, etc.) and a practical review procedure for identifying this class of defect in cryptographic code. Worth reading before designing or auditing any system where a hash, signature, or replay-protection scheme depends on serialized representations.</li> <li><strong>SOC/IR — Skip</strong></li> <li><strong>Leader — Skip</strong></li> </ul>