CVE-2026-13762

CVE-2026-13762 involves an vulnerability in Amazon CloudFront when AWS WAF is enabled. The issue arises from an inconsistent interpretation of HTTP/2 requests, which can allow remote actors to bypass AWS WAF managed body‑inspection by fragmenting the request body across frames so that only a part...

CVE-2026-13762

Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue was...

CVE-2026-55603

A flaw was found in http-proxy-middleware. A remote attacker could exploit a vulnerability in the fixRequestBody function, which is used to re-emit a request body. By injecting carriage return and line feed characters \r\n into a request body key or value, an attacker can bypass security policies...

PT-2026-53691

Name of the Vulnerable Software and Affected Versions Amazon CloudFront affected versions not specified Description An inconsistent interpretation of HTTP/2 requests in Amazon CloudFront when AWS WAF is enabled may allow remote actors to bypass managed rule body inspection. This occurs through...

PT-2026-53692

Name of the Vulnerable Software and Affected Versions AWS Application Load Balancer affected versions not specified Description Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer when AWS WAF is enabled may allow remote actors to bypass managed rule body inspection. B...

GHSA-JQ4M-Q6P2-8GWC Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM

Summary hackneyh3:awaitresponseloop/6 in src/hackneyh3.erl accumulates the HTTP/3 response body in memory without any size cap. The after Timeout clause is a per-message inactivity timer, not a wall-clock deadline: every received streamdata chunk, housekeeping select message, or settings frame...

Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM

Summary hackneyh3:awaitresponseloop/6 in src/hackneyh3.erl accumulates the HTTP/3 response body in memory without any size cap. The after Timeout clause is a per-message inactivity timer, not a wall-clock deadline: every received streamdata chunk, housekeeping select message, or settings frame...

Hackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body

Summary The HTTP/3 redirect handler in src/hackneyh3.erl forwards the original request headers Authorization, Cookie, Proxy-Authorization and, for 307/308 responses, the original request body to the redirect target without checking whether the target host matches the origin. When followredirect i...

GHSA-H73Q-4W9Q-82H4 Hackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body

Summary The HTTP/3 redirect handler in src/hackneyh3.erl forwards the original request headers Authorization, Cookie, Proxy-Authorization and, for 307/308 responses, the original request body to the redirect target without checking whether the target host matches the origin. When followredirect i...

EUVD-2026-39822

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, Envoy can translate a downstream HTTP/3 request that is complete at the transport layer HEADERS with FIN / headers-only close but still carries a nonzero...

CVE-2026-57876: Out-of-bounds Write

An unauthenticated out-of-bounds write vulnerability exists in onvif.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when processing HTTP request body data. A remote attacker may exploit this vulnerability by sending a...

GO-2026-5757 MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint in github.com/minio/minio

MinIO vulnerable to Path Traversal via msgpack Body in ReadMultiple Storage-REST Endpoint in github.com/minio/minio. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

GO-2026-5641 CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests in github.com/crowdsecurity/crowdsec

CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests in github.com/crowdsecurity/crowdsec...

GO-2026-5734 Mattermost MS Teams plugin doesn't limit the request body size on the /lifecycle webhook endpoint in github.com/mattermost/mattermost-plugin-msteams

Mattermost MS Teams plugin doesn't limit the request body size on the /lifecycle webhook endpoint in github.com/mattermost/mattermost-plugin-msteams...

GO-2026-5489 Mattermost doesn't limit the size of the request body on the start meeting API endpoint in github.com/mattermost/mattermost-plugin-msteams-meetings

Mattermost doesn't limit the size of the request body on the start meeting API endpoint in github.com/mattermost/mattermost-plugin-msteams-meetings...

GO-2026-5454 Mattermost doesn't validate the response body of proxied images in github.com/mattermost/mattermost-server

Mattermost doesn't validate the response body of proxied images in github.com/mattermost/mattermost-server...

GO-2026-5376 Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes in github.com/axllent/mailpit

Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes in github.com/axllent/mailpit...

GO-2026-5269 Volcano's webhook server vulnerable to OOM due to unbounded HTTP request body size in volcano.sh/volcano

Volcano's webhook server vulnerable to OOM due to unbounded HTTP request body size in volcano.sh/volcano...

GO-2026-5153 Mattermost MS Teams plugin doesn't limit the request body size on the /changes webhook endpoint in github.com/mattermost/mattermost-plugin-msteams

Mattermost MS Teams plugin doesn't limit the request body size on the /changes webhook endpoint in github.com/mattermost/mattermost-plugin-msteams...

CVE-2026-54278

A flaw was found in aiohttp, an asynchronous HTTP client/server framework. An attacker could send a specially crafted compressed request body that, during cleanup, would be decompressed into memory in one large chunk. This could potentially lead to a Denial of Service DoS condition, where the...