314 matches found
servu-cve-2026-28318-poc
CVE-2026-28318 — SolarWinds Serv-U "Content-Encoding: deflate" pre-auth crash Root-cause analysis + DoS proof-of-concept. The public advisory classifies this as an unauthenticated denial-of-service / uncontrolled resource consumption. Binary analysis shows the underlying defect is memory-safety :...
CVE-2026-28318-check
SolarWinds Serv-U Unauthenticated DoS: Safe Detection Script A safe, non-destructive detector for CVE-2026-28318 , an unauthenticated denial-of-service in SolarWinds Serv-U= 15.5.4.108. A single POST that carries Content-Encoding: deflate and a body feeds that body to an in-memory deflate...
Imperva_gzip_WAF_Bypass
Imperva Web Application Firewall WAF POST Request Bypass Imperva Cloud WAF was vulnerable to a bypass that allows attackers to evade WAF rules when sending malicious HTTP POST payloads, such as log4j exploits, SQL injection, command execution, directory traversal, XXE, etc. Remediation The Imperv...
Imperva_gzip_bypass
Imperva Web Application Firewall WAF POST Request Bypass Imperva Cloud WAF was vulnerable to a bypass that allows attackers to evade WAF rules when sending malicious HTTP POST payloads, such as log4j exploits, SQL injection, command execution, directory traversal, XXE, etc. Remediation The Imperv...
Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by a denial of service vulnerability due to Apache HttpComponents Client
Summary Apache HttpComponents Client is used by IBM Integrated Analytics System as an HTTP client library for Java applications. CVE-2026-64607 affects classic I/O-based Apache HttpClient versions 5.0-alpha1 through 5.6.2, where the client fails to properly release underlying connections back to...
EUVD-2026-102240
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings...
EUVD-2026-108189
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body...
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
Impact A single request can crash any application using body-parser with default options. When a request carries a Content-Encoding for example gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one val...
CLEANSTART-2026-RC74250 HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...
CVE-2026-64607 affects multiple packages. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. See references for individual...
PT-2026-122410
Impact A single request can crash any application using body-parser with default options. When a request carries a Content-Encoding for example gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one val...
Linux Distros Unpatched Vulnerability : CVE-2026-111181
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash an...
AZL-110999 CVE-2026-111181 affecting package js-jquery 3.5.0-4
body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a...
AZL-111059 CVE-2026-111181 affecting package python-tensorboard 2.16.2-6
body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a...
CVE-2026-111181
body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a...
CVE-2026-111181
The body-parser middleware for Node.js and Express is vulnerable to a Denial of Service (DoS) attack in versions before 1.20.9 and 2.0.0 before 2.4.0 . When a request uses Content-Encoding (e.g., gzip ), the middleware pipes data into a decompression stream but fails to attach an error listener. ...
CVE-2026-111181 body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a...
CVE-2026-111181 body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a...
CVE-2026-111181 body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a...
CVE-2026-111181
body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a...
PT-2026-121403
Name of the Vulnerable Software and Affected Versions body-parser versions prior to 1.20.9 body-parser versions 2.0.0 through 2.3.x Description An issue exists where a single request can crash an application using default options. When a request uses a Content-Encoding like gzip, the software pip...