[pkg-uWSGI-devel] Fwd: Possible uWSGI security vulnerability

[Carlos Pastor]

Thanks!

On Mon, Sep 7, 2026, 11:24 Alexandre Rossi <niol at zincube.net> wrote:

> Hi,
>
> >> No ASCII character fulfills the condition of being less than '0' and
> >> at the same time greater than '9', for example. Therefore the check is
> >> always false.
> >>
> >> The corrected version is right: it is not an hex character if it is
> >> not between 0 and 9 AND not between a and f AND not between A and F.
>
> Thanks for clarifying.
>
> I submitted a fix.
> https://github.com/unbit/uwsgi/pull/2778
>
> Not sure of the security implications though.
>
> Alex
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-uwsgi-devel/attachments/20260907/f46fb4f1/attachment.htm>