CVE-2026-21876

CVE-2026-21876 OWASP CRS WAF bypass CVE-2026-21876 docker container + minimal PoC. I would like to thank @airween and @fzipi separately for their quick response! The vulnerability fix was ready in a very short time. PoC POST /submit HTTP/1.1 Host: localhost User-Agent: curl/8.17.0 Accept: / Origi...

CVE-2024-35333

CVE-2024-35333 A stack buffer overflow vulnerability exists in the charset handling functionality of html2xhtml version 1.3. An attacker can exploit this vulnerability by providing a specially crafted input, which would lead to the overflow of the 'buf' variable located on the stack. Successful...

Linux Distros Unpatched Vulnerability : CVE-2026-114136

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in restframework/parsers.py uses the client-supplied...

EUVD-2026-107546

Django REST framework: JSONParser applies an attacker-named codec to the request stream...

Django REST framework: JSONParser applies an attacker-named codec to the request stream

Summary An unauthenticated attacker can defeat Django's DATAUPLOADMAXMEMORYSIZE limit and force a worker process to allocate arbitrary memory, by naming a compression codec in the Content-Type charset parameter. A 108-byte request body produces a 50,331,648-character value inside the view, an...

httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc

A flaw was found in the modxml2enc module of the Apache HTTP Server. An untrusted backend server can cause a Denial of Service DoS by returning a crafted response with a character set whose conversion partially succeeds and then fails. Processing this response triggers an invalid memory access nu...

CVE-2026-114136

A flaw was found in Django REST framework. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by exhausting server memory. The issue occurs because the JSON parser accepts arbitrary client-supplied charset encodings, including decompression codecs, rathe...

DEBIAN-CVE-2026-114136

Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in restframework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2codec rather than only text encodings. A remote...

CVE-2026-114136

Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in restframework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2codec rather than only text encodings. A remote...

CVE-2026-114136

The Django REST framework is vulnerable in versions 3.6.4 through 3.18.2 due to an issue in rest_framework/parsers.py. The JSONParser.parse function incorrectly uses the client-supplied Content-Type charset value with codecs.getreader, which allows for byte-transform codecs like bz2_codec . A rem...

CVE-2026-114136 Django REST framework: JSONParser applies an attacker-named codec to the request stream

Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in restframework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2codec rather than only text encodings. A remote...

CVE-2026-114136 Django REST framework: JSONParser applies an attacker-named codec to the request stream

Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in restframework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2codec rather than only text encodings. A remote...

CVE-2026-114136

Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in restframework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2codec rather than only text encodings. A remote...

CVE-2026-114136

Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in restframework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2codec rather than only text encodings. A remote...

CVE-2026-114101 Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass

Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename=iso-8859-1''shell.php, or filename alone, so...

CVE-2026-114101

Coraza versions prior to 3.8.1 are vulnerable to a FILES rule bypass due to improper handling of multipart upload filenames. The issue stems from the use of Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters if the charset is not utf-8 or us-ascii . This allows unauthe...

CVE-2026-114101 Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass

Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename=iso-8859-1''shell.php, or filename alone, so...

PT-2026-120802

Name of the Vulnerable Software and Affected Versions Django REST framework versions 3.6.4 through 3.18.1 Description The JSONParser.parse function in rest framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader. This allows the use of byte-transform codecs,...

GO-2026-6691 Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza

Coraza: Multipart filename RFC 5987 charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza...

GHSA-3WR7-993Q-JRFF Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules

Summary Coraza extracts a multipart file upload's filename using Go's standard-library mime.ParseMediaType, which only decodes the RFC 5987/6266 extended filename Content-Disposition parameter when its declared charset is exactly us-ascii or utf-8. Any other charset — including iso-8859-1, which...