PT-2026-114978

Name of the Vulnerable Software and Affected Versions kin-openapi versions prior to 0.145.0 Description An unauthenticated remote client can trigger a denial of service by sending an unsupported or non-canonical HTTP method such as PROPFIND or lowercase get to an existing static path. The...

PT-2026-115093

Name of the Vulnerable Software and Affected Versions react/http versions 1.0.0 through 1.11.0 Description ReactHttpBrowser fails to enforce a size limit on the internal buffer used to store response-header bytes. When the handleData function in ClientRequestStream receives data, it appends...

Security Updates for Microsoft Visual Studio Products 17.14.42 and 18.10.4 (October 2026)

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network. CVE-2026-105016 - Inconsistent interpretation of http requests...

Linux Distros Unpatched Vulnerability : CVE-2026-109855

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is...

RHCOS 4 : OpenShift Container Platform 4.18.57 (RHSA-2026:79034)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:79034 advisory. - net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGSMAXFRAMESIZE frame CVE-2026-33814 No...

UBUNTU-CVE-2026-103930

cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::openstream in httplib.h accepts a caller-controlled path that reaches detail::writerequestline without the detail::encodepath protection used by the ordinary buffered request path. Raw carriage-return and...

CVE-2026-104827: Allocation of Resources Without Limits or Throttling

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid stat...

CVE-2026-79829: Improper Input Validation

A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt...

CVE-2026-109855

undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the...

CVE-2026-18659: Incorrect Authorization

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods...

PT-2026-114951

Name of the Vulnerable Software and Affected Versions symfony/http-foundation versions 4.1.0-BETA1 through 5.4.53 symfony/http-foundation versions 6.0.0-BETA1 through 6.4.45 symfony/http-foundation versions 7.0.0-BETA1 through 7.4.18 symfony/http-foundation versions 8.0.0-BETA1 through 8.1.6...

CVE-2026-109855: Uncaught Exception

undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the...

UBUNTU-CVE-2026-109855

undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the...

CVE-2026-101899

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NOPROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NOPROXY while a proxy is...

UBUNTU-CVE-2026-101899

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NOPROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NOPROXY while a proxy is...

CVE-2026-105660: Improper Validation of Syntactic Correctness of Input

Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target. Bandit validate...

CVE-2026-95101

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject...

UBUNTU-CVE-2026-95101

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject...

CVE-2026-110835

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

PT-2026-115119

Name of the Vulnerable Software and Affected Versions undici versions 7.0.0 through 7.30.0 undici versions 8.0.0 through 8.12.1 Description An issue exists in this HTTP client library for Node.js when an originless Agent composes redirect and cache interceptors in that specific order while using ...