diff --git a/CHANGES b/CHANGES
index 6e792110d8..e85aae8e22 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+6254.	[cleanup]	Add semantic patch to do an explicit cast from char
+			to unsigned char in ctype.h class of functions.
+			[GL #4327]
+
 6252.	[test]		Python system tests have to be executed by invoking
 			pytest directly. Executing them with the legacy test
 			runner is no longer supported. [GL #4250]
diff --git a/cocci/ctype.spatch b/cocci/ctype.spatch
new file mode 100644
index 0000000000..2b392cb310
--- /dev/null
+++ b/cocci/ctype.spatch
@@ -0,0 +1,105 @@
+@@
+char T;
+@@
+
+- isalnum(T)
++ isalnum((unsigned char)T)
+
+@@
+char T;
+@@
+
+- isalpha(T)
++ isalpha((unsigned char)T)
+
+@@
+char T;
+@@
+
+- iscntrl(T)
++ iscntrl((unsigned char)T)
+
+@@
+char T;
+@@
+
+- isdigit(T)
++ isdigit((unsigned char)T)
+
+@@
+char T;
+@@
+
+- isgraph(T)
++ isgraph((unsigned char)T)
+
+@@
+char T;
+@@
+
+- islower(T)
++ islower((unsigned char)T)
+
+@@
+char T;
+@@
+
+- isprint(T)
++ isprint((unsigned char)T)
+
+@@
+char T;
+@@
+
+- ispunct(T)
++ ispunct((unsigned char)T)
+
+@@
+char T;
+@@
+
+- isspace(T)
++ isspace((unsigned char)T)
+
+@@
+char T;
+@@
+
+- isupper(T)
++ isupper((unsigned char)T)
+
+@@
+char T;
+@@
+
+- isxdigit(T)
++ isxdigit((unsigned char)T)
+
+@@
+char T;
+@@
+
+- isascii(T)
++ isascii((unsigned char)T)
+
+@@
+char T;
+@@
+
+- isblank(T)
++ isblank((unsigned char)T)
+
+@@
+char T;
+@@
+
+- tolower(T)
++ tolower((unsigned char)T)
+
+@@
+char T;
+@@
+
+- toupper(T)
++ toupper((unsigned char)T)
+
diff --git a/contrib/dlz/modules/common/dlz_dbi.c b/contrib/dlz/modules/common/dlz_dbi.c
index 88ff6328f4..d8e1909c44 100644
--- a/contrib/dlz/modules/common/dlz_dbi.c
+++ b/contrib/dlz/modules/common/dlz_dbi.c
@@ -474,7 +474,7 @@ get_parameter_value(const char *input, const char *key) {
 
 	for (i = 0; i < 255; i++) {
 		value[i] = keystart[keylen + i];
-		if (isspace(value[i]) || value[i] == '\0') {
+		if (isspace((unsigned char)value[i]) || value[i] == '\0') {
 			value[i] = '\0';
 			break;
 		}
diff --git a/lib/dns/rdata.c b/lib/dns/rdata.c
index b7f9ed2b61..592b9746da 100644
--- a/lib/dns/rdata.c
+++ b/lib/dns/rdata.c
@@ -2059,7 +2059,7 @@ decvalue(char value) {
 	 * isascii() is valid for full range of int values, no need to
 	 * mask or cast.
 	 */
-	if (!isascii(value)) {
+	if (!isascii((unsigned char)value)) {
 		return (-1);
 	}
 	if ((s = strchr(decdigits, value)) == NULL) {
diff --git a/lib/isc/httpd.c b/lib/isc/httpd.c
index b15cc45448..a93f9e1393 100644
--- a/lib/isc/httpd.c
+++ b/lib/isc/httpd.c
@@ -340,8 +340,10 @@ value_match(const struct phr_header *header, const char *match) {
 	limit = header->value_len - match_len + 1;
 
 	for (size_t i = 0; i < limit; i++) {
-		if (isspace(header->value[i])) {
-			while (i < limit && isspace(header->value[i])) {
+		if (isspace((unsigned char)header->value[i])) {
+			while (i < limit &&
+			       isspace((unsigned char)header->value[i]))
+			{
 				i++;
 			}
 			continue;