CVE-2026-127122

P-Net before 1.0.4 does not check the number of MCR request blocks in a Connect request against the number of multicast communication relations that an Application Relationship has room for PNETMAXMCCR, 1 by default. Each further block is written past the end of the array, into the rest of the...

CVE-2026-127122 Out-of-bounds write with too many MCR blocks in a Connect request

P-Net before 1.0.4 does not check the number of MCR request blocks in a Connect request against the number of multicast communication relations that an Application Relationship has room for PNETMAXMCCR, 1 by default. Each further block is written past the end of the array, into the rest of the...

CVE-2026-127122

P-Net versions prior to 1.0.4 are vulnerable to an out-of-bounds write because the software fails to validate the number of MCR request blocks in a Connect request against the allocated capacity (PNET_MAX_MC_CR ). An attacker with ADJACENT network access can provide excessive blocks, causing data...

EUVD-2026-125302

P-Net before 1.0.4 does not check the number of MCR request blocks in a Connect request against the number of multicast communication relations that an Application Relationship has room for PNETMAXMCCR, 1 by default. Each further block is written past the end of the array, into the rest of the...

CVE-2026-85720

A flaw was found in the AsyncHttpClient library. When a Java application uses an HTTP proxy to connect to an HTTPS origin, the library sends sensitive origin credentials, such as Basic, Digest, NTLM, Kerberos, or SPNEGO tokens, in the plaintext CONNECT request. This occurs before a secure TLS...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2026-3225)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3225 advisory. When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server reject...

Important: golang

Issue Overview: When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connectio...

Amazon Linux 2 : golang (ALAS-2026-4005)

The version of golang installed on the remote host is prior to 1.26.9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4005 advisory. When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the...

Important: golang

Issue Overview: When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connectio...

ROS-20261022-73-0069

A vulnerability exists in the httpproxyconnect function, due to the introduction of a CONNECT request by the RDP client FreeRDP. This vulnerability is related to the introduction of HTTP proxy requests/headers in the proxy server, allowing an attacker to execute arbitrary requests...

PT-2026-115882

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

EUVD-2026-101718

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

Linux Distros Unpatched Vulnerability : CVE-2026-110835

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected a...

CVE-2026-110835

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

CVE-2026-110835 FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

CVE-2026-110835 FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

CVE-2026-110835

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

CVE-2026-110835 FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

CVE-2026-110835

FreeRDP versions 3.0.0 before 3.32.0 are vulnerable to HTTP header injection within their proxy functionality. The root cause is the failure to reject a lone LF character in the target portion of a routing token (specifically Cookie: msts= ). This allows the http_proxy_connect function to write t...

CLEANSTART-2026-BA60559 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne...

CVE-2026-94439 affects multiple packages. When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. See references for individual vulnerability details...