Medium: nerdctl

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

EulerOS 2.0 SP8 : golang (EulerOS-SA-2024-2030)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the...

GHSA-753J-MPMX-QQ6G Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado

Summary When Tornado receives a request with two Transfer-Encoding: chunked headers, it ignores them both. This enables request smuggling when Tornado is deployed behind a proxy server that emits such requests. Pound does this. PoC 0. Install Tornado. 1. Start a simple Tornado server that echoes...

Medium: golist

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

Medium: amazon-ecr-credential-helper

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

BIT-NODE-2024-22019

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service DoS. The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk...

CVE-2024-31617

OpenLiteSpeed before 1.8.1 mishandles chunked encoding...

CVE-2024-31617

OpenLiteSpeed versions prior to 1.8.1 are vulnerable to a security flaw due to the mishandling of chunked encoding . This issue is associated with CWE-770 , which involves the Allocation of Resources Without Limits or Throttling . The impact is categorized as a low availability impact with a CVSS...

CVE-2024-31617

OpenLiteSpeed before 1.8.1 mishandles chunked encoding...

CVE-2024-31617

OpenLiteSpeed before 1.8.1 mishandles chunked encoding...

CVE-2024-31617

OpenLiteSpeed before 1.8.1 mishandles chunked encoding...

CVE-2024-31617

OpenLiteSpeed before 1.8.1 mishandles chunked encoding...

PT-2024-24157 · Unknown · Openlitespeed

Name of the Vulnerable Software and Affected Versions: OpenLiteSpeed versions prior to 1.8.1 Description: The issue is related to the mishandling of chunked encoding. Recommendations: For versions prior to 1.8.1, update to version 1.8.1 or later to resolve the issue...

Litespeed Technologie OpenLiteSpeed 安全漏洞

Litespeed Technologie OpenLiteSpeed is an open source web server from Litespeed Technologie. A security vulnerability exists in versions of OpenLiteSpeed prior to 1.8.1 that stems from an inability to properly handle chunked encoding...

CVE-2024-31617: Allocation of Resources Without Limits or Throttling

OpenLiteSpeed before 1.8.1 mishandles chunked encoding...

squid: Denial of Service in HTTP Chunked Decoding

A flaw was found in Squid. This issue may allow a remote attacker to trigger an uncontrolled recursion bug when sending a specially crafted, chunked, encoded HTTP Message, resulting in a denial of service...

Medium: ecs-init

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

Medium: cni-plugins

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

SUSE: Security Advisory (SUSE-SU-2024:1114-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Rocky Linux 8 : nodejs:20 (RLSA-2024:1687)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:1687 advisory. - The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For exampl...