rewrite-cve-2026-22732

rewrite-cve-2026-22732 Receita OpenRewrite que detecta código suscetível ao CVE-2026-22732, uma falha do Spring Security em que definir Content-Length por meio de um dos três métodos de resposta ignora o OnCommittedResponseWrapper do Spring Security. Como o wrapper nunca vê o cabeçalho,...

CLZero

CLZero مشروع لفحص ناقلات هجوم تهريب الطلبات CL.0 HTTP/1.1. حول شكرًا لـ @albinowax و@defparam و@d3d وإلا لما كانت هذه الأداة موجودة. مستوحاة من أداة Smuggler، جميع أدوات الهجوم مقتبسة من Smuggler ومن https://portswigger.net/research/how-to-turn-security-research-into-profit لمزيد من المعلومات راج...

w48crash

Overflow del buffer dello stack in WebMod CVE-2007-1260 di cybermind Kevin Masterson [email protected] Sito di WebMod archiviato: https://web.archive.org/web/20080517044559/http://djeyl.net/w.php Versioni vulnerabili: 0.48, sia Win32 che Linux. Le versioni precedenti potrebbero essere...

CVE-2026-38427

CVE-2026-38427: Integer Wraparound → Heap Buffer Overflow in Tasmota fetchjpg CVE: CVE-2026-38427 Severity: Critical CVSS 9.8 Product: Arendst Tasmota Affected Version: = 15.3.0.3 File: tasmota/tasmotaxdrvdriver/xdrv10scripter.ino Function: fetchjpg — case 2 MJPEG frame fetch Author: Saidakbarxon...

CVE-2022-45059-demo

CVE-2022-45059-Demo Die Varnish-Cache-Versionen 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.1.0, 7.1.1 und 7.2.0 weisen eine Request-Smuggling-Schwachstelle auf, bei der ein Angreifer erreichen kann, dass der Content-Length-Header als Hop-by-Hop-Header behandelt wird. Dies ist eine Demo bestehend aus einer...

CVE-2026-73051

A flaw was found in actix-http. This vulnerability allows unauthenticated remote attackers to perform HTTP request smuggling. By sending specially crafted HTTP/1.1 requests that include both Content-Length and Transfer-Encoding: chunked headers, an attacker can desynchronize backend requests...

CVE-2019-19945_Test

CVE-2019-19945Test Este é o código para o primeiro CVE proposto 1. Instale o Docker 2. Construa e execute o servidor cd Server docker build -t server/cve . docker run -d --name server -p 80:80 server/cve 3. Obtenha o IP do contêiner do servidor Linux sudo docker container inspect server | grep -i...

CVE-2024-38828

Sicherheitslücke CVE-2024-38828 Beschreibung Der Test prüft das Verhalten/die Reaktion im Spring Framework mit und ohne die Sicherheitslücke CVE-2024-38828. In ByteArrayHttpMessageConverter wird Speicher im ByteArrayOutputStream basierend auf dem Anfrageheader Content-Length alloziert, was...

SAPGateBreaker-Exploit

CVE-2022-22536: HTTP-Schmuggel durch SAPs Haupteingang SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 und SAP Web Dispatcher sind anfällig für Request-Smuggling und Request-Verkettung. Ein nicht authentifizierter Angreifer kann...

citrixmash_scanner

CVE-2019-19781 citrixmash Scanner Ein multithreaded Scanner für Citrix-Geräte, die anfällig für CVE-2019-19781 sind. Der Scanner versucht nicht, Hosts zu kompromittieren/auszunutzen und vermeidet das Herunterladen sensibler Inhalte. Ein HEAD-Request wird verwendet, um festzustellen, ob ein Ziel...

Astra Linux – Vulnerability in Waitress

Waitress version 1.3.1 allows for the smuggling of requests by sending the Content-Length header twice. Waitress would fold the two Content-Length headers together, and since it cannot convert the now comma-separated values into integers, it internally sets the Content-Length to 0. If two...

Astra Linux – Vulnerability in Tomcat9

If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26, or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers by setting rejectIllegalHeader to false the default for 8.5.x only, Tomcat would not reject requests containing an invalid Content-Length header. This...

CVE-2026-73257 Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling

Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The clcount and tecount checks in the mghttpparse and httpcb paths in src/http.c accept both...

USN-8650-1: Cap'n Proto vulnerabilities

Chanho Kim and Jihyeok Han discovered that Cap'n Proto incorrectly handled negative Content-Length values or excessively large chunk sizes when processing HTTP messages. An attacker could possibly use these issues to cause HTTP messages to be interpreted inconsistently, resulting in HTTP request ...

USN-8650-1 capnproto vulnerabilities

Chanho Kim and Jihyeok Han discovered that Cap'n Proto incorrectly handled negative Content-Length values or excessively large chunk sizes when processing HTTP messages. An attacker could possibly use these issues to cause HTTP messages to be interpreted inconsistently, resulting in HTTP request ...

Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-2060)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2060 advisory. brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in the number of consecutive non-expanding '' brace groups. An attack...

BIT-NODE-MIN-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

BIT-NODE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

K000162941: NodeJS vulnerability CVE-2026-58044

Security Advisory Description A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers...

PT-2026-73402

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...