12837 matches found
CVE-2026-93751 uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecChars
uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequenc...
EUVD-2026-83256
uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequenc...
CVE-2026-93751
uri-js through version 4.4.1 is affected by an improper UTF-8 decoding flaw in the pctDecChars() function. The function incorrectly decodes invalid and overlong percent-encoded sequences into ASCII metacharacters, allowing attackers to craft payloads that bypass platform decoder validation and in...
CVE-2026-93751
uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequenc...
Infinite loop
Overview uri-js is a RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript. Affected versions of this package are vulnerable to Infinite loop via the removeDotSegments function, which loops infinitely when a path segment begins with Unicode line...
CVE-2026-93690
uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...
DEBIAN-CVE-2026-93690
uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...
CVE-2026-93690
uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...
UBUNTU-CVE-2026-93690
uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...
CVE-2026-54148
http4k (a Kotlin HTTP toolkit) is vulnerable in the http4k-security-digest module. The DigestAuthProvider.verify method did not compare the uri parameter in an Authorization: Digest response with the actual request URL, meaning a captured valid Digest authentication response could be replayed aga...
CVE-2026-54148 http4k: `DigestAuthProvider.verify` did not bind to request URI
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest does not compare the uri parameter in an Authorization: Digest response with the actual request URL. An attacker who captures a valid Digest...
CVE-2026-93690
uri-js (an npm JavaScript URI library) versions through 4.4.1 are affected by a Denial of Service vulnerability in the removeDotSegments function. The root cause is an infinite loop triggered when a path segment begins with a Unicode line or paragraph separator . An attacker can exploit this remo...
EUVD-2026-82986
uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...
CVE-2026-93690 uri-js through 4.4.1 Denial of Service via removeDotSegments
uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...
CVE-2026-93690 uri-js through 4.4.1 Denial of Service via removeDotSegments
uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...
CVE-2026-93690
uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...
AZL-103496 CVE-2026-93600 affecting package rust 1.75.0-31
rustls-webpki rustls/webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issu...
AZL-103527 CVE-2026-93600 affecting package rust-afterburn 5.8.2-2
rustls-webpki rustls/webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issu...
DEBIAN-CVE-2026-93600
rustls-webpki rustls/webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issu...
CVE-2026-93600
rustls-webpki rustls/webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issu...