EUVD-2026-83287

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers...

CVE-2026-11710

IBM WebSphere Application Server 8.5 (versions 8.5.5.0 through 8.5.5.30) is vulnerable to HTTP request smuggling caused by improper handling of Content-Length headers (CWE-444). The flaw allows an attacker to send crafted requests that are interpreted differently by the server versus downstream c...

CVE-2026-93560

A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service DoS by exhausting memo...

CVE-2026-93560 Io.netty/netty-codec-stomp: netty: stomp codec content-length long-to-int truncation causes infinite decode loop dos

A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service DoS by exhausting memo...

CLZero

CLZero HTTP/1.1 CL.0 요청 스머글링 공격 벡터를 퍼징하기 위한 프로젝트입니다. 소개 도구가 존재할 수 있게 해준 @albinowax, @defparam, @d3d에게 감사드립니다. Smuggler 도구에서 영감을 받았으며, 모든 공격 가젯은 Smuggler와 https://portswigger.net/research/how-to-turn-security-research-into-profit 에서 가져왔습니다. 자세한 내용은...

rewrite-cve-2026-22732

rewrite-cve-2026-22732 CVE-2026-22732에 취약한 코드를 탐지하는 OpenRewrite 레시피입니다. 이는 세 가지 응답 메서드 중 하나를 통해 Content-Length를 설정하면 Spring Security의 OnCommittedResponseWrapper를 우회하는 Spring Security 결함입니다. 래퍼가 헤더를 인식하지 못하므로 onResponseCommitted가 실행되지 않고, 지연 추가되는 보안 헤더X-Frame-Options, X-Content-Type-Options,...

citrixmash_scanner

CVE-2019-19781 citrixmash 스캐너 CVE-2019-19781에 취약한 Citrix 어플라이언스를 위한 멀티스레드 스캐너입니다. 이 스캐너는 호스트를 손상시키거나 악용하려 시도하지 않으며, 민감한 콘텐츠를 다운로드하지 않습니다. 대상이 취약한지 확인하기 위해 HEAD 요청을 사용합니다. content-length 헤더 응답에서 특정 값을 검증하여 오탐false positive을 줄입니다. citrixsmashscanner는 네트워크 범위와 개별 호스트를 모두 입력으로 받을 수 있습니다. 설치...

CVE-2024-38828

CVE-2024-38828 脆弱性 説明 このテストは、Spring Framework において CVE-2024-38828 の脆弱性がある場合とない場合の動作・応答を検証します。 ByteArrayHttpMessageConverter では、リクエストヘッダー Content-Length に基づいて ByteArrayOutputStream にメモリが割り当てられますが、実際のボディが 0 バイトである場合と一致しない可能性があります。このようなリクエストが急増すると DoS、メモリ使用効率が悪くなり、定期的な GC...

CVE-2019-19945_Test

CVE-2019-19945Test 이것은 첫 번째 제안된 CVE를 위한 코드입니다. 1. Docker 설치 2. 서버 빌드 및 실행 cd Server docker build -t server/cve . docker run -d --name server -p 80:80 server/cve 3. 서버 컨테이너 IP 가져오기 Linux sudo docker container inspect server | grep -i IPAddress Windows Powershell docker container inspect server |...

Linux Distros Unpatched Vulnerability : CVE-2023-54397

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content- Length headers accepting non-standard characters...

CVE-2026-69217

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/1.1 parser accepts differing duplicate Content-Length headers and uses the last value instead of rejecting the message. When an Ember server is behind a keep-alive intermediary that selects a different...

CVE-2026-69217 Http4s: Ember Server accepts duplicate Content-Length headers

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/1.1 parser accepts differing duplicate Content-Length headers and uses the last value instead of rejecting the message. When an Ember server is behind a keep-alive intermediary that selects a different...

CVE-2026-69217

Http4s (a Scala HTTP service interface) is vulnerable to CL.CL request smuggling due to its Ember HTTP/1.1 parser accepting differing duplicate Content-Length headers and using the last value instead of rejecting the message. Affected versions are prior to 0.23.35 and 1.0.0-M47 . When an Ember se...

EUVD-2026-79193

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/1.1 parser accepts differing duplicate Content-Length headers and uses the last value instead of rejecting the message. When an Ember server is behind a keep-alive intermediary that selects a different...

CVE-2026-69217 Http4s: Ember Server accepts duplicate Content-Length headers

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/1.1 parser accepts differing duplicate Content-Length headers and uses the last value instead of rejecting the message. When an Ember server is behind a keep-alive intermediary that selects a different...

CVE-2026-69204

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rules. When ember-server is behind a keep-alive intermediary...

CVE-2026-69204

CVE-2026-69204 affects Http4s , a Scala HTTP library, specifically the Ember HTTP/1.1 implementation. The root cause is that Ember does not reject messages containing both Transfer-Encoding and Content-Length headers, allowing an intermediary and Ember to select different body framing rules. This...

EUVD-2026-79025

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rules. When ember-server is behind a keep-alive intermediary...

CVE-2026-69204 Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rules. When ember-server is behind a keep-alive intermediary...

CVE-2026-69204 Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rules. When ember-server is behind a keep-alive intermediary...