Apache2 - Transfer-Encoding Chunked XSS

Apache2 PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 contain a reflected cross-site scripting vulnerability caused by mishandling of chunked transfer-encoding requests in sapi/apache2handler/sapiapache2.c. Attackers can execute malicious scripts via crafted...

CVE-2021-40346

CVE-2021-40346 CVE-2021-40346 PoC HAProxy HTTP Smuggling Solo con fines educativos Configuración root@kitploit: $ docker build -t cve-2021-40346 . $ docker run --name poc -p 8000:80 -d --rm -it cve-2021-40346 4941e9f23508b497e4cbe334a75e7cdb84c83478522ed85f48db3477f97a6fb4 Prueba Confirma que...

CVE-2026-66731-Negative-Chunk-Size-Parsing-Causes-Memory-Corruption-leading-to-Server-Crash

Security Advisory: Negative Chunk-Size Parsing Causes Memory Corruption in facil.io Assigned CVE ID : CVE-2026-66731 Product: facil.io Affected versions: facil.io = 0.7.5 0.7.5, 0.7.6, master; introduced when the 0.8.x HTTP/1.1 parser was backported in 0.7.5 - not present in 0.6.x or 0.7.0–0.7.3...

CVE-2020-25613

POC root@kitploit: POST / HTTP/1.1 Host: 127.0.0.1:1080 Content-Type: text/html Content-Length: 129 Connection: keep-alive Transfer-Encoding: 0xb chunked 1 A 0 POST /flag HTTP/1.1 Host: 127.0.0.1:1080 Content-Length: 180 Connection: keep-alive Content-Type: text/html URI:...

jetty-line-check

jetty-line-check 你这套 Jetty或 Spring Boot 带进来的 Jetty,中了 2026 年这六条 CVE 的哪几条 —— 而官方叫你升的那一版,在 Maven Central 上到底存不存在? 主打 CVE-2026-2332GHSA-355h-qmc2-wpwf,high / CVSS v3 7.4:jetty-http 的 chunked 请求走私。 2026-09-17 官方又发了同族的 CVE-2026-19203LF EXT.TERM 走私,high / CVSS v4 8.3:它的 9.4 线覆盖到 9.4.63 , 官方叫你升 9.4.64 —...

cve-2023-33476

CVE-2023-33476 ReadyMedia MiniDLNA versiones desde 1.1.15 hasta 1.3.2 es vulnerable a un desbordamiento de búfer. La vulnerabilidad es causada por una lógica de validación incorrecta al manejar peticiones HTTP que usan codificación de transferencia por fragmentos. Esto provoca que otro código...

CVE-2026-67181-HTTP-Request-Smuggling-via-Transfer-Encoding-Desynchronization-rouille-

Security Advisory: HTTP Request Smuggling via Transfer-Encoding Desynchronization rouille Assigned CVE ID: CVE-2026-67181 Summary rouille::proxy::proxy forwards the client's Transfer-Encoding header to the backend unchanged, but writes the request body that tinyhttp has already de-chunked. It nev...

CVE-2025-55315

CVE-2025-55315 Explotación de prueba de concepto para CVE-2025-55315 Contrabando de solicitudes HTTP en .NET. Demuestra cómo la codificación fragmentada chunked encoding mal interpretada permite a atacantes introducir solicitudes de contrabando a través de proxies y balanceadores de carga en...

CVE-2013-2028_Checker

CVE-2013-2028 - Desbordamiento de búfer en la pila por codificación fragmentada chunked en Nginx HTTP Server 1.3.9-1.4.0 Descripción La función ngxhttpparsechunked en http/ngxhttpparse.c en nginx 1.3.9 hasta 1.4.0 permite a atacantes remotos causar una denegación de servicio bloqueo y ejecutar...

CVE-2024-21762

CVE-2024-21762 - Herramienta de detección y explotación de FortiGate SSL VPN RCE Herramienta de detección y explotación para CVE-2024-21762 - Vulnerabilidad crítica en FortiGate SSL VPN ⚠️ AVISO LEGAL : Esta herramienta es exclusivamente para uso en entornos de prueba autorizados. El uso no...

CVE-2019-19945_Test

CVE-2019-19945Prueba Este es el código para la primera CVE propuesta. 1. Instalar Docker 2. Construir y ejecutar servidor cd Server docker build -t server/cve . docker run -d --name server -p 80:80 server/cve 3. Obtener la IP del contenedor del servidor Linux sudo docker container inspect server ...

CVE-2026-84997

react/http (ReactPHP) is vulnerable to a denial-of-service via a malformed HTTP chunked body. The ChunkedDecoder enters an infinite loop when it receives either an incomplete terminal-chunk trailer without CRLF or exactly two non-CRLF bytes after a completed non-terminal chunk, because handleData...

GHSA-9998-894R-FWVR Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)

Summary Ember's HTTP/1.1 header parser matches the Transfer-Encoding header value with a case-sensitive substring test hValue.contains"chunked". RFC 9112 §7 requires transfer-coding names to be compared case-insensitively. A request carrying Transfer-Encoding: Chunked capital C is therefore not...

Astra Linux - Vulnerability in Golang-1.19

A malicious HTTP sender can use chunk extensions to cause the recipient reading from the request or response body to read much more bytes from the network than actually exist in the body. A malicious HTTP client can further exploit this to cause the server to automatically read a large amount of...

Astra Linux – Vulnerability in Twisted

In Twisted Web version 19.10.0, there was an HTTP request splitting vulnerability. When a content-length and a chunked encoding header were provided, the content-length took precedence, and the remaining part of the request body was interpreted as a pipelined request...

Astra Linux – Vulnerability in Squid

Squid is a web proxy cache. Starting from version 3.5.27 and before version 6.8, Squid may be vulnerable to a Denial of Service attack against the HTTP Chunked decoder due to an uncontrolled recursion bug. This issue allows a remote attacker to cause a Denial of Service when sending a crafted,...

Astra Linux – Vulnerability in Puma

Puma is a Ruby/Rack web server designed for parallelism. Prior to versions 6.3.1 and 5.6.7, Puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers, which could allow HTTP request smuggling. The severity of this issue depends heavily ...

DEBIAN-CVE-2026-89044

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding...

CVE-2026-89044 Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding...

A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

Summary A malformed HTTP message using Transfer-Encoding: chunked can drive React\Http\Io\ChunkedDecoder into an infinite loop, pegging a CPU core and freezing the event loop. Because ReactPHP is single-threaded, one such message stalls the entire process for every client until it is killed. Both...