CVE-2026-54388

Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing values, forwarding all duplicate headers to the backend while using the first value to determine how many request body bytes to consume. Remote attackers can...

CVE-2026-54388

Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing values, forwarding all duplicate headers to the backend while using the first value to determine how many request body bytes to consume. Remote attackers can...

CVE-2026-54388

Tinyproxy (≤ 1.11.3) is affected by CVE-2026-54388. The issue occurs when a request contains multiple Content-Length headers with differing values: Tinyproxy forwards all duplicate headers to the backend but uses the first value to determine how many body bytes to consume. This desynchronizes pro...

CVE-2026-54388 Tinyproxy - HTTP Request Smuggling via Duplicate Content-Length Headers

Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing values, forwarding all duplicate headers to the backend while using the first value to determine how many request body bytes to consume. Remote attackers can...

EUVD-2026-37790

Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing values, forwarding all duplicate headers to the backend while using the first value to determine how many request body bytes to consume. Remote attackers can...

CVE-2026-54388 Tinyproxy - HTTP Request Smuggling via Duplicate Content-Length Headers

Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing values, forwarding all duplicate headers to the backend while using the first value to determine how many request body bytes to consume. Remote attackers can...

CVE-2026-54387 Tinyproxy - HTTP Request Smuggling via CL/TE Desynchronization

Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the...

CVE-2026-54387

Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the...

EUVD-2026-37789

Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the...

CVE-2026-54387 Tinyproxy - HTTP Request Smuggling via CL/TE Desynchronization

Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the...

CVE-2026-54387

CVE-2026-54387 affects Tinyproxy up to version 1.11.3. It fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to consume the request body. This desynchronizes frontend/backend parsers and can enab...

DRUPAL-CORE-2026-007

Drupal core ships a rebuild.php front controller that can be used to rebuild Drupal clearing the caches and rebuilding the container when the site is in an unexpected condition. This script doesn't correctly check the Host header against the list of trusted host patterns. This could result in cac...

com.github.jknack:handlebars-guava-cache (0.11.0), com.github.jknack:handlebars-humanize (0.11.0) +4 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.11.0)

com.github.jknack:handlebars MAVEN version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-guava-cache 0.11.0 - com.github.jknack:handlebars-humanize 0.11.0 -...

com.github.jknack:handlebars-guava-cache (0.12.0), com.github.jknack:handlebars-humanize (0.12.0) +5 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.12.0)

com.github.jknack:handlebars MAVEN version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-guava-cache 0.12.0 - com.github.jknack:handlebars-humanize 0.12.0 -...

com.github.jknack:handlebars-guava-cache (1.1.0), com.github.jknack:handlebars-humanize (1.1.0) +6 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (1.1.0)

com.github.jknack:handlebars MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-guava-cache 1.1.0 - com.github.jknack:handlebars-humanize 1.1.0 -...

com.github.jknack:handlebars-guava-cache (1.1.1), com.github.jknack:handlebars-humanize (1.1.1) +6 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (1.1.1)

com.github.jknack:handlebars MAVEN version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-guava-cache 1.1.1 - com.github.jknack:handlebars-humanize 1.1.1 -...

com.github.jknack:handlebars-guava-cache (1.2.0), com.github.jknack:handlebars-helpers (1.2.0) +6 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (1.2.0)

com.github.jknack:handlebars MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-guava-cache 1.2.0 - com.github.jknack:handlebars-helpers 1.2.0 -...

com.github.jknack:handlebars-guava-cache (2.3.0), com.github.jknack:handlebars-helpers (2.3.0) +11 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (2.3.0)

com.github.jknack:handlebars MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-guava-cache 2.3.0 - com.github.jknack:handlebars-helpers 2.3.0 -...

com.github.jknack:handlebars-guava-cache (2.3.1), com.github.jknack:handlebars-helpers (2.3.1) +8 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (2.3.1)

com.github.jknack:handlebars MAVEN version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-guava-cache 2.3.1 - com.github.jknack:handlebars-helpers 2.3.1 -...

Use of Cache Containing Sensitive Information

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the cache interceptor. An attacker can obtain another user's authenticated response data by exploiting whitespace-padded...