AZL-71849 CVE-2025-66471 affecting package python-urllib3 1.26.19-3

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than...

UBUNTU-CVE-2025-66471

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than...

EUVD-2022-5067

Malicious code in bioql PyPI...

Denial Of Service (DoS)

@hapi/subtext is vulnerable to Denial Of Service DoS. The vulnerability is due to improper parsing of the Content-Encoding HTTP header, which causes a system error on invalid values and is rethrown up the stack without handling, allowing an attacker to crash the application and shut down services...

CVE-2022-29577

OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets CSS content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367...

Internet Bug Bounty: CVE-2025-0725: Heap overflow in curl with Content-Encoding gzip and old libz versions

A vulnerability was reported in the curl project, where a heap overflow could be triggered by a malicious HTTP server serving abnormally large gzip headers. The vulnerability was caused by an integer overflow in curl's support for old libz versions when the Content-Encoding: gzip header was used...

httpd: HTTP response splitting

A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers, resulting in an HTTP response splitting...

httpd: HTTP response splitting

A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers, resulting in an HTTP response splitting...

httpd: HTTP response splitting

A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers, resulting in an HTTP response splitting...

Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

Summary An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. Details The OpenTelemetry Collector handles compressed HTTP requests by recognizing the Content-Encoding header, rewriting the HTTP request body, and allowing...

PT-2024-4606

Name of the Vulnerable Software and Affected Versions: OpenTelemetry Collector versions prior to 0.102.1 confighttp module versions prior to 0.102.0 configgrpc module versions prior to 0.102.1 Description: An unsafe decompression vulnerability allows unauthenticated attackers to crash the collect...

Cisco Secure Web Appliance Content Encoding Filter Bypass (cisco-sa-wsa-bypass-vXvqwzsj)

According to its self-reported version, the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass a configured rule, allowing traffic onto a network that should have been blocked. This vulnerability is due to improper...

Cisco Secure Web Appliance Content Encoding Filter Bypass Vulnerability

A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass a configured rule, allowing traffic onto a network that should have been blocked. This vulnerability is due to improper detection of malicious...

SUSE CVE-2019-2126

In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a freed pointer. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0...

Cisco Secure Web Appliance Content Encoding Filter Bypass Vulnerabilities

Multiple vulnerabilities in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance, formerly Cisco Web Security Appliance WSA, could allow an unauthenticated, remote attacker to bypass a configured rule, thereby allowing traffic onto a network that should have been blocked...

UBUNTU-CVE-2022-39956

The OWASP ModSecurity Core Rule Set CRS is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields that will not be decoded and...

CLSA-2022-1663184017 Fixed CVEs in curl: CVE-2022-32208, CVE-2022-32206

CVE-2022-32208: krb5: fix returning error on decode errors - CVE-2022-32206: contentencoding: return error on too many compression steps - fix a curl.spec's comment about applying TuxCare ELS patches - improve the test system by repeating failed tests several times...

CLSA-2022-1663183179 Fixed CVEs in curl: CVE-2022-32208, CVE-2022-32206

CVE-2022-32208: krb5: fix returning error on decode errors - CVE-2022-32206: contentencoding: return error on too many compression steps - fix a curl.spec's comment about applying TuxCare ELS patches - improve the test system by repeating failed tests several times...

ws-xmlrpc DoS Vulnerability

The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service resource consumption by decompressing a large file containing zeroes...

GHSA-R2PG-W96P-PCPJ ws-xmlrpc DoS Vulnerability

The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service resource consumption by decompressing a large file containing zeroes...