CVE-2026-28318-check

SolarWinds Serv-U 未认证拒绝服务：安全检测脚本 一个安全的、非破坏性 的检测器，用于 CVE-2026-28318 ，该漏洞是 SolarWinds Serv-U= 15.5.4.125。不受影响。 有响应，但无 Serv-U 服务器头| NOT-SERV-U not-servu| 不是 Serv-U 服务器，或者代理剥离了该头。 无可用响应 / 连接失败| ERROR no-response| HTTP 服务不可达、被过滤、TLS 错误或超时。 目标通过探测响应的自身 Server 头被识别为 Serv-U，因此无需单独的识别请求。...

Imperva_gzip_bypass

Imperva Web应用防火墙 WAF POST请求绕过 Imperva Cloud WAF 存在一个绕过漏洞，允许攻击者在发送恶意 HTTP POST 负载（如 log4j 漏洞利用、SQL 注入、命令执行、目录遍历、XXE 等）时规避 WAF 规则。 修复措施 Imperva 团队在收到报告后高度重视，并在短短几天内完成了全局修复，值得称赞。自 2021 年 12 月 22 日起，所有 Cloud WAF 客户已自动获得补丁。Imperva 团队合作愉快，显然拥有成熟、专业且能力强大的安全团队。 漏洞利用方法 向 HTTP POST 请求中添加 Content-Encoding:...

servu-cve-2026-28318-poc

CVE-2026-28318 — SolarWinds Serv-U "Content-Encoding: deflate" caída pre-autenticación Análisis de causa raíz + prueba de concepto de DoS. El aviso público clasifica esto como una denegación de servicio / consumo no controlado de recursos no autenticada. El análisis binario muestra que el defecto...

Imperva_gzip_WAF_Bypass

Bypass de peticiones POST en Imperva Web Application Firewall WAF Imperva Cloud WAF era vulnerable a un bypass que permite a los atacantes evadir las reglas del WAF al enviar payloads HTTP POST maliciosos, como exploits de log4j, inyección SQL, ejecución de comandos, traversal de directorios, XXE...

Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

ImpactWho is impacted: - Any application using Zapros to make HTTP requests to untrusted servers - Applications that follow redirects to attacker-controlled hostsAttack vector: - A malicious HTTP server returns a response with many chained content encodings. When the client attempts to decode, it...

EUVD-2026-71634

undici vulnerable to Denial of Service via unbounded decompression of compressed responses...

undici vulnerable to Denial of Service via unbounded decompression of compressed responses

Impact The interceptors.decompress interceptor decompresses HTTP response bodies according to the untrusted Content-Encoding header. The number of decompression layers is capped at 5, but the total decompressed output size is not bounded and there is no option to limit it. A malicious or faulty...

CLEANSTART-2026-CL40927 undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header

Security vulnerability affects the langfuse package. undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header...

openSUSE 16: httpcomponents-client / httpcomponents-client-cache / etc (openSUSE-SU-2026:21894-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21894-1 advisory. This update for httpcomponents-client fixes the following issue: - CVE-2026-64607: improper release of underlying connection back to connection manager...

Security Bulletin: HttpClient based on the classic i/o model fails to correctly release the underlying connection

Summary HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the...

org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak

A flaw was found in Apache HttpComponents Client, specifically in its classic input/output I/O model. When processing a response message with an invalid or unsupported Content-Encoding header, the client fails to properly release the underlying network connection. This connection leak can lead to...

GHSA-5VJJ-2R48-Q622 Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Impact Who is impacted: - Any application using Zapros to make HTTP requests to untrusted servers - Applications that follow redirects to attacker-controlled hosts Attack vector: - A malicious HTTP server returns a response with many chained content encodings. When the client attempts to decode, ...

Allocation of Resources Without Limits or Throttling

Overview zapros is a Modern and extensible HTTP client for Python. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via getcontentdecoder in src/zapros/models.py, where an attacker can send an HTTP response with an unbounded number of...

Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Impact Who is impacted: - Any application using Zapros to make HTTP requests to untrusted servers - Applications that follow redirects to attacker-controlled hosts Attack vector: - A malicious HTTP server returns a response with many chained content encodings. When the client attempts to decode, ...

EUVD-2026-84182

Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service...

BIT-NIFI-2026-70469 Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests

Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instances of the Content-Encoding header and d...

CVE-2026-61541

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to...

CVE-2026-61541

Zapros , a Python HTTP client, is vulnerable to denial of service in versions prior to 0.14.0 . The root cause is an unbounded chained Content-Encoding decompression chain : when an application requests content from an untrusted server (or follows a redirect to one), a malicious response containi...

CVE-2026-61541 Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to...

CVE-2026-61541 Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to...