CVE-2026-1467

A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF Carriage Return Line Feed Injection, occurs when an HTTP proxy is configured and the library improperly handles URL-decoded input used to create the Host header. A remote attacker can exploit this by providing ...

CVE-2026-1467 Libsoup: libsoup: http header injection via specially crafted urls when an http proxy is configured

A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF Carriage Return Line Feed Injection, occurs when an HTTP proxy is configured and the library improperly handles URL-decoded input used to create the Host header. A remote attacker can exploit this by providing ...

[SECURITY] [DSA 6112-1] openjdk-21 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6112-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 27, 2026 https://www.debian.org/security/faq -...

Debian dsa-6112 : openjdk-21-dbg - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6112 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6112-1 [email protected] https://www.debian.org/securit...

LibSoup injection vulnerability

Libsoup is a GNOME project’s HTTP client/server library. Libsoup has a vulnerability due to improper handling of URL decoding when configuring HTTP proxies, which may lead to CRLF injection attacks...

Gakido vulnerable to HTTP Header Injection (CRLF Injection)

A vulnerability was discovered in Gakido that allowed HTTP Header Injection through CRLF Carriage Return Line Feed sequences in user-supplied header values and names. When making HTTP requests with user-controlled header values containing \r\n CRLF, \n LF, or \x00 null byte characters, an attacke...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by a Request Smuggling Vulnerability in Netty (CVE-2025-67735)

Summary Netty is used by IBM DevOps Deploy / IBM UrbanCode Deploy UCD as part of the agent-server and server-server inter-communication services. CVE-2025-67735 Vulnerability Details CVEID:CVE-2025-67735 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. In version...

[SECURITY] [DLA 4456-1] openjdk-17 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4456-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort January 26, 2026 https://wiki.debian.org/LTS -...

Debian dla-4456 : openjdk-17-dbg - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4456 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4456-1 [email protected]...

[SECURITY] [DSA 6110-1] openjdk-17 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6110-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 25, 2026 https://www.debian.org/security/faq -...

Debian dsa-6110 : openjdk-17-dbg - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6110 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6110-1 [email protected] https://www.debian.org/securit...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection via improper validation of environment variable values in the container configuration process. An attacker can execute arbitrary commands as root on the host by injecting newlines into environment variables, which results...

ALPINE-CVE-2025-15366

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection via the urllib.request.DataHandler. An attacker can manipulate HTTP headers by injecting newline characters in the mediatype portion of a data URL, to alter request behavior or bypass security controls. Remediation A fix...

MiracleLinux 8 : python-urllib3-1.24.2-5.el8 (AXSA:2021-1947:01)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2021-1947:01 advisory. python-urllib3: CRLF injection via HTTP request method CVE-2020-26137 Tenable has extracted the preceding description block directly from the MiracleLinux...

MiracleLinux 8 : python27:2.7 (AXSA:2020-969:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-969:01 advisory. python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure CVE-2018-20060 python: Cookie domain check...

MiracleLinux 4 : rh-python36-python-pip-9.0.1-5.AXS4, rh-python36-python-3.6.12-1.AXS4, rh-python36-python-virtualenv-15.1.0-3.AXS4 (AXSA:2020-818:02)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-818:02 advisory. python: XSS vulnerability in the documentation XML-RPC server in servertitle field CVE-2019-16935 python: CRLF injection via the host part of the url...

MiracleLinux 8 : python38:3.8 (AXSA:2021-2422:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2422:01 advisory. python: CRLF injection via HTTP request method in httplib/http.client CVE-2020-26116 python-lxml: mXSS due to the use of improper parser...

MiracleLinux 8 : python3-3.6.8-37.el8 (AXSA:2021-2061:02)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2061:02 advisory. python: CRLF injection via HTTP request method in httplib/http.client CVE-2020-26116 python: Unsafe use of eval on data retrieved via HTTP in the te...

MiracleLinux 7 : python-2.7.5-92.0.1.el7.AXS7 (AXSA:2022-3427:14)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-3427:14 advisory. python: CRLF injection via HTTP request method in httplib/http.client CVE-2020-26116 python-urllib3: CRLF injection via HTTP request method...