netty: Netty: HTTP request smuggling via URI manipulation and CRLF injection

A flaw was found in Netty. A remote attacker can bypass request-line validation by manipulating the URI after a DefaultHttpRequest or DefaultFullHttpRequest is created. This vulnerability, a form of Carriage Return Line Feed CRLF injection, allows for the insertion of additional HTTP or RTSP...

netty: Netty: HTTP request smuggling via URI manipulation and CRLF injection

A flaw was found in Netty. A remote attacker can bypass request-line validation by manipulating the URI after a DefaultHttpRequest or DefaultFullHttpRequest is created. This vulnerability, a form of Carriage Return Line Feed CRLF injection, allows for the insertion of additional HTTP or RTSP...

apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities

A flaw was found in Apache Thrift. This vulnerability encompasses an origin validation error, improper limitation of a pathname to a restricted directory path traversal, and improper neutralization of CRLF sequences in HTTP headers HTTP request/response splitting. A remote attacker could exploit...

Security Bulletin:Vulnerability in form-data affects IBM Netezza Appliance

Summary The form-data package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-12143 Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the fie...

EulerOS 2.0 SP11 : ruby (EulerOS-SA-2026-3155)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in...

RCE (Remote Code Execution) form-data Dependency in Bamboo Data Center

This High severity RCE Remote Code Execution vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.

Summary Multiple Vulnerabilities were addressed in IBM Decision Optimization for Cloud Pak for Data version 5.4.0 before Patch 4. Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the field...

Security Bulletin: form-data CRLF Injection via Unescaped Field Name and Filename

Summary form-data versions through 4.0.5 are vulnerable to CRLF injection CWE-93, CVSS 7.5, High. Field names and filenames passed to FormDataappend are not sanitized before being written into the Content-Disposition header, allowing an attacker who controls those values to inject arbitrary heade...

undici vulnerable to CRLF Injection via blob-like body 'type' property

...

CVE-2026-48083 OpenReception: Unauthenticated POST /api/log accepts arbitrary content with CRLF injection and no size or rate limits

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the /api/log endpoint accepts unauthenticated POST requests, applies no schema validation to the message body, writes attacker-controlled content directly into the...

EulerOS 2.0 SP13 : ruby (EulerOS-SA-2026-2997)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4,...

EulerOS 2.0 SP13 : ruby (EulerOS-SA-2026-3047)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4,...

DEBIAN-CVE-2026-71311

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

CVE-2026-71311

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input

A flaw was found in Net::IMAP before 0.4.24, 0.5.14, and 0.6.4. Several commands accept raw string arguments sent to the server without validation or escaping; if derived from user-controlled input, CRLF sequences allow injection of arbitrary IMAP commands...

net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input

A flaw was found in Net::IMAP before 0.4.24, 0.5.14, and 0.6.4. Several commands accept raw string arguments sent to the server without validation or escaping; if derived from user-controlled input, CRLF sequences allow injection of arbitrary IMAP commands...

net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input

A flaw was found in Net::IMAP before 0.4.24, 0.5.14, and 0.6.4. Several commands accept raw string arguments sent to the server without validation or escaping; if derived from user-controlled input, CRLF sequences allow injection of arbitrary IMAP commands...

net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input

A flaw was found in Net::IMAP before 0.4.24, 0.5.14, and 0.6.4. Several commands accept raw string arguments sent to the server without validation or escaping; if derived from user-controlled input, CRLF sequences allow injection of arbitrary IMAP commands...

Important: ruby:3.3 security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fixes: zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command...

GHSA-M8RV-5G2X-5CG5 undici vulnerable to CRLF Injection via blob-like body 'type' property

Impact When an application passes a duck-typed blob-like body to undici's HTTP/1.1 dispatcher via request, stream, pipeline, or dispatch with a .type derived from untrusted input, an attacker can inject CRLF sequences \r\n to append arbitrary HTTP headers and potentially smuggle a second request...