CVE-2026-88773

CVE-2026-88773: NetScaler nsppe HTTP Smuggle 32-bit chunk-size accumulator wrap in the HTTP/1.1 parser TL;DR The nsppe HTTP/1.1 chunked-body parser reads the chunk-size field into a 32-bit register and never checks for overflow. Nine or more hex digits and the value silently wraps: 100000005 2^32...

CVE-2026-88773

CVE-2026-88773 - NetScaler nsppe 32-bit chunk-size accumulator wrap by Fyyre - https://github.com/Fyyre Proof-of-concept for an HTTP request-smuggling issue in the NetScaler nsppe HTTP/1.1 chunked-body parser. A nine-digit chunk-size value 100000005 is accumulated into a 32-bit register with no...

io.netty/netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing

A flaw was found in Netty's netty-codec-http component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an...

io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line

A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can le...

io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line

A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can le...

io.netty/netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing

A flaw was found in Netty's netty-codec-http component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an...

io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line

A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can le...

io.netty/netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing

A flaw was found in Netty's netty-codec-http component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an...

Exploit for HTTP Request Smuggling in Citrix Netscaler_Application_Delivery_Controller

CVE-2026-88773 - NetScaler nsppe 32-bit chunk-size accumulator...

CVE-2026-91920

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size ...

Linux Distros Unpatched Vulnerability : CVE-2026-91920

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs...

UBUNTU-CVE-2026-91920

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size ...

CVE-2026-91920

A flaw exists in the ChunkReader component of the Undertow web server used for handling chunked transfer encoding in HTTP requests. The root cause is that a security check for the chunk size is performed before the value is shifted, allowing a specially crafted 15-digit chunk size to bypass limit...

CVE-2026-91920 Undertow: undertow: chunkreader message length permits chunk-size overflow

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size ...

CVE-2026-91920 Undertow: undertow: chunkreader message length permits chunk-size overflow

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size ...

CVE-2026-91920

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size ...

CVE-2026-91920: Red Hat: A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer…

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size ...

openSUSE 16 Security Update : haproxy (openSUSE-SU-2026:22162-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22162-1 advisory. This update for haproxy fixes the following issue: - h1-htx: report an error on a too long chunk-size line bsc1285046. Changes for haproxy: - Otel Updat...

Security update for haproxy (moderate)

openSUSE security update: security update for haproxy ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22162-1 Rating: moderate References: bsc1285046 Affected Products: openSUSE Leap 16.0 -------------------------------------------------------------...

Security update for haproxy

This update for haproxy fixes the following issue: h1-htx: report an error on a too long chunk-size line bsc1285046. Changes for haproxy: Otel Update to version 2.3.0+git2.b031728: DOC: otel: added a security policy to the repository MINOR: otel: test: added a test with an optional upstream conte...