diff --git a/CHANGES b/CHANGES
index 6c0ba022b1..ad52987e2f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+6254.	[cleanup]	Add semantic patch to do an explicit cast from char
+			to unsigned char in ctype.h class of functions.
+			[GL #4327]
+
 6253.	[cleanup]	Remove the support for control channel over Unix
 			Domain Sockets. [GL #4311]
 
diff --git a/bin/tests/system/rpz/testlib/dummylib.c b/bin/tests/system/rpz/testlib/dummylib.c
index d9ebdd306d..71e3de6c1c 100644
--- a/bin/tests/system/rpz/testlib/dummylib.c
+++ b/bin/tests/system/rpz/testlib/dummylib.c
@@ -535,7 +535,7 @@ get_cstr_zones(const char *cstr, trpz_rsp_t *trsp, size_t *pnzones) {
 	while (tptr != NULL && *tptr != '\0') {
 		tok = strsep(&tptr, ";\n");
 
-		while (isspace(*tok)) {
+		while (isspace((unsigned char)*tok)) {
 			tok++;
 		}
 
@@ -547,7 +547,7 @@ get_cstr_zones(const char *cstr, trpz_rsp_t *trsp, size_t *pnzones) {
 
 			tok += 5;
 
-			while (isspace(*tok)) {
+			while (isspace((unsigned char)*tok)) {
 				tok++;
 			}
 
@@ -570,7 +570,8 @@ get_cstr_zones(const char *cstr, trpz_rsp_t *trsp, size_t *pnzones) {
 				qend = tok;
 			}
 
-			while (*qend != '\0' && !isspace(*qend)) {
+			while (*qend != '\0' && !isspace((unsigned char)*qend))
+			{
 				qend++;
 			}
 
diff --git a/bin/tests/system/rpz/testlib/test-data.c b/bin/tests/system/rpz/testlib/test-data.c
index d48e216b29..3ffbce28fe 100644
--- a/bin/tests/system/rpz/testlib/test-data.c
+++ b/bin/tests/system/rpz/testlib/test-data.c
@@ -1147,7 +1147,7 @@ sanity_check_data_file(const char *fname, char **errp) {
 			continue;
 		}
 
-		while (*lptr && !isspace(*lptr)) {
+		while (*lptr && !isspace((unsigned char)*lptr)) {
 			lptr++;
 		}
 
@@ -1171,7 +1171,7 @@ sanity_check_data_file(const char *fname, char **errp) {
 			goto out;
 		}
 
-		while (isspace(*lptr)) {
+		while (isspace((unsigned char)*lptr)) {
 			lptr++;
 		}
 
@@ -1280,7 +1280,7 @@ load_all_updates(const char *fname, trpz_result_t **presults, size_t *pnresults,
 			continue;
 		}
 
-		while (*lptr && !isspace(*lptr)) {
+		while (*lptr && !isspace((unsigned char)*lptr)) {
 			lptr++;
 		}
 
@@ -1343,7 +1343,7 @@ load_all_updates(const char *fname, trpz_result_t **presults, size_t *pnresults,
 		}
 
 		/* Everything here is an update */
-		while (isspace(*lptr)) {
+		while (isspace((unsigned char)*lptr)) {
 			lptr++;
 		}
 
@@ -1421,7 +1421,7 @@ wdns_str_to_name(const char *str, uint8_t **pbuf, bool downcase) {
 			}
 			*data++ = c;
 			res++;
-		} else if (c == '\\' && !isdigit(*p)) {
+		} else if (c == '\\' && !isdigit((unsigned char)*p)) {
 			/* an escaped character */
 			if (slen <= 0) {
 				goto out;
@@ -1441,7 +1441,9 @@ wdns_str_to_name(const char *str, uint8_t **pbuf, bool downcase) {
 			d[2] = *p++;
 			d[3] = '\0';
 			slen -= 3;
-			if (!isdigit(d[0]) || !isdigit(d[1]) || !isdigit(d[2]))
+			if (!isdigit((unsigned char)d[0]) ||
+			    !isdigit((unsigned char)d[1]) ||
+			    !isdigit((unsigned char)d[2]))
 			{
 				goto out;
 			}
diff --git a/cocci/ctype.spatch b/cocci/ctype.spatch
new file mode 100644
index 0000000000..2b392cb310
--- /dev/null
+++ b/cocci/ctype.spatch
@@ -0,0 +1,105 @@
+@@
+char T;
+@@
+
+- isalnum(T)
++ isalnum((unsigned char)T)
+
+@@
+char T;
+@@
+
+- isalpha(T)
++ isalpha((unsigned char)T)
+
+@@
+char T;
+@@
+
+- iscntrl(T)
++ iscntrl((unsigned char)T)
+
+@@
+char T;
+@@
+
+- isdigit(T)
++ isdigit((unsigned char)T)
+
+@@
+char T;
+@@
+
+- isgraph(T)
++ isgraph((unsigned char)T)
+
+@@
+char T;
+@@
+
+- islower(T)
++ islower((unsigned char)T)
+
+@@
+char T;
+@@
+
+- isprint(T)
++ isprint((unsigned char)T)
+
+@@
+char T;
+@@
+
+- ispunct(T)
++ ispunct((unsigned char)T)
+
+@@
+char T;
+@@
+
+- isspace(T)
++ isspace((unsigned char)T)
+
+@@
+char T;
+@@
+
+- isupper(T)
++ isupper((unsigned char)T)
+
+@@
+char T;
+@@
+
+- isxdigit(T)
++ isxdigit((unsigned char)T)
+
+@@
+char T;
+@@
+
+- isascii(T)
++ isascii((unsigned char)T)
+
+@@
+char T;
+@@
+
+- isblank(T)
++ isblank((unsigned char)T)
+
+@@
+char T;
+@@
+
+- tolower(T)
++ tolower((unsigned char)T)
+
+@@
+char T;
+@@
+
+- toupper(T)
++ toupper((unsigned char)T)
+
diff --git a/contrib/dlz/modules/common/dlz_dbi.c b/contrib/dlz/modules/common/dlz_dbi.c
index 88ff6328f4..d8e1909c44 100644
--- a/contrib/dlz/modules/common/dlz_dbi.c
+++ b/contrib/dlz/modules/common/dlz_dbi.c
@@ -474,7 +474,7 @@ get_parameter_value(const char *input, const char *key) {
 
 	for (i = 0; i < 255; i++) {
 		value[i] = keystart[keylen + i];
-		if (isspace(value[i]) || value[i] == '\0') {
+		if (isspace((unsigned char)value[i]) || value[i] == '\0') {
 			value[i] = '\0';
 			break;
 		}
diff --git a/lib/isc/httpd.c b/lib/isc/httpd.c
index 6ce2ca979c..57cc0fd943 100644
--- a/lib/isc/httpd.c
+++ b/lib/isc/httpd.c
@@ -333,8 +333,10 @@ value_match(const struct phr_header *header, const char *match) {
 	limit = header->value_len - match_len + 1;
 
 	for (size_t i = 0; i < limit; i++) {
-		if (isspace(header->value[i])) {
-			while (i < limit && isspace(header->value[i])) {
+		if (isspace((unsigned char)header->value[i])) {
+			while (i < limit &&
+			       isspace((unsigned char)header->value[i]))
+			{
 				i++;
 			}
 			continue;