24245 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-12547
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority host:port. When the proxy configuration changes e.g., via...
Linux Distros Unpatched Vulnerability : CVE-2026-16730
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup notably SOPEERPIDFD are handled as...
Linux Distros Unpatched Vulnerability : CVE-2026-66339
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to...
Linux Distros Unpatched Vulnerability : CVE-2026-54478
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018...
DEBIAN-CVE-2026-66338
A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend...
DEBIAN-CVE-2026-66339
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials,...
CVE-2026-66338
A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend...
CVE-2026-66339
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials,...
UBUNTU-CVE-2026-66339
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials,...
CVE-2026-66338
The CVE-2026-66338 issue affects libsoup, specifically the HTTP chunked transfer encoding parser. The vulnerability stems from a permissive parsing function used for chunk sizes in soup_body_input_stream_read_chunked(), which accepts inputs violating RFC 9112 (leading whitespace, plus sign prefix...
CVE-2026-66338 Libsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()
A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend...
CVE-2026-66339 Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials,...
CVE-2026-66339
CVE-2026-66339 is a vulnerability in libsoup where, after establishing a CONNECT tunnel via an HTTP proxy, the library incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests through the tunnel. This can allow the destination server to capture proxy credentials, resulting...
CVE-2026-66339
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials,...
CVE-2026-66339
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials,...
GHSA-46Q4-43PH-C6FR blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)
Summary blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names/values e.g. X-Forwarded-For, internal-auth headers that a fronting proxy sanitized from the...
GHSA-MHVJ-JHPQ-885V blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser
Summary Five independent HTTP/1.1 conformance laxities in blaze's hand-written Java parser http/src/main/java/org/http4s/blaze/http/parser/ cause request-boundary disagreement with a stricter intermediary. All are reachable from a default BlazeServerBuilder with no non-default configuration. Impa...
GHSA-P279-2CQP-84JG OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check
Summary When a SASL PLAIN bind supplies an authorization identity authzid that resolves to a different user, PlainSASLMechanismHandler verified only the PROXIEDAUTH privilege and never evaluated the "proxy" access-control right the mayProxy ACI scope check. As a result, any account holding the...
GHSA-FRVJ-C5QP-XJ4W open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
AI assistance was used to help inspect the code and prepare this report. Summary The fix for GHSA-r2wg-2mcr-66rv is incomplete in v0.9.6 and current main. backend/openwebui/routers/terminals.py documents sanitizeproxypath as decoding until stable, but the implementation stops after 8 unquote...
