AIKIDO-2026-10267

TL;DR

Affected versions of this package contain an out-of-bounds read in Digest authentication due to the use of memcmp() with a fixed length to compare the algorithm field, which could read past the intended buffer if the input is shorter or improperly terminated. An attacker controlling or influencing the algorithm value (e.g., via a malicious server response or crafted authentication header) could trigger memory disclosure or application instability by causing unintended memory access. The patch replaces memcmp() with strcasecmp() to ensure safe, null-terminated string comparison and prevent buffer over-reads.