build1 distinct publisher
Six CVEs trace one bypass class to an unspecified decode order in RFC 3986
A gateway ACL and a backend router are separate parsers with no agreed decode order, which is why /%2Fadmin still lands. Normalizing earlier relocates the window; refusing ambiguous paths is what closes it.
Publishers:dev.to
Reality
- Evidence58
- Adoption57
- Hype gap+18
- Incentives22