CVE-2026-66731-Negative-Chunk-Size-Parsing-Causes-Memory-Corruption-leading-to-Server-Crash

Security Advisory: Negative Chunk-Size Parsing Causes Memory Corruption in facil.io Assigned CVE ID : CVE-2026-66731 Product: facil.io Affected versions: facil.io = 0.7.5 0.7.5, 0.7.6, master; introduced when the 0.8.x HTTP/1.1 parser was backported in 0.7.5 - not present in 0.6.x or 0.7.0–0.7.3...

puma: Puma: HTTP Request Smuggling via Underscore Header Name Confusion

A flaw was found in Puma. An attacker could exploit a vulnerability within the HTTP parser component to execute arbitrary code. This could allow the attacker to take control of the affected system...

puma: Puma: HTTP Request Smuggling via Underscore Header Name Confusion

A flaw was found in Puma. An attacker could exploit a vulnerability within the HTTP parser component to execute arbitrary code. This could allow the attacker to take control of the affected system...

[SECURITY] Fedora 43 Update: perl-HTTP-Parser-XS-0.18-1.fc43

HTTP::Parser::XS is a fast, primitive HTTP request parser that can be used either for writing a synchronous HTTP server or an event- driven server...

[SECURITY] Fedora 44 Update: perl-HTTP-Parser-XS-0.18-1.fc44

HTTP::Parser::XS is a fast, primitive HTTP request parser that can be used either for writing a synchronous HTTP server or an event- driven server...

tomcat-line-check

tomcat-line-check CVE-2026-24880 · GHSA-563x-q5rq-57qp —— Does Apache's upgrade to version 11.0.20, 10.1.52 or 9.0.116 actually apply to you? For most people it doesn't, and there are four different ways it doesn't apply. This tool scans your artifacts and tells you which one it is. java -jar...

CVE-2026-57488

A flaw was found in pupnp. An integer truncation vulnerability in the HTTP parser allows an adjacent network attacker to cause a Denial of Service DoS. When processing the Content-Length header on 64-bit systems, large integer values can truncate or wrap, causing the parser to miscalculate the...

SUSE CVE-2026-116130

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

OPENSUSE-SU-2026:12389-1 perl-HTTP-Parser-XS-0.180.0-1.1 on GA media

These are all security issues fixed in the perl-HTTP-Parser-XS-0.180.0-1.1 package on the GA media of openSUSE Tumbleweed...

Debian dla-4876 : python-aiohttp-doc - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4876 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4876-1 [email protected]...

CLEANSTART-2025-RY23854 HTTP parser in all current versions of Node

CVE-2018-7159 affects multiple packages. The HTTP parser in all current versions of Node. See references for individual vulnerability details...

CLEANSTART-2024-TS97808 LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces

Security vulnerability affects the suricata package. LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces...

CVE-2026-116130

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

Linux Distros Unpatched Vulnerability : CVE-2026-116130

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and...

CVE-2026-116130

A flaw was found in HTTP::Parser::XS. When processing HTTP request paths, the parser URL-decodes the path and terminates the string at decoded null bytes rather than using the full path length. A remote attacker can exploit this flaw by sending a crafted path containing an encoded null byte %00 t...

CVE-2026-116130

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

DEBIAN-CVE-2026-116130

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

UBUNTU-CVE-2026-116130

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

CVE-2026-116130

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

CVE-2026-116130 HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...