62055 matches found
AZL-98481 CVE-2026-71562 affecting package erlang for versions less than 26.2.5.21-6
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...
CVE-2026-71380
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...
CVE-2026-71562
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...
DEBIAN-CVE-2026-71380
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...
CVE-2026-71380
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...
UBUNTU-CVE-2026-71380
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...
WordPress Divi plugin <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Dynamic Content Legacy JSON Format Shortcode vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Theme Divi versions = 4.27.6...
CVE-2026-73812
Erlang/OTP inets (HTTP server module) is vulnerable to HTTP Request Smuggling (CL.TE desync) when deployed behind a Content-Length-preferring front-end proxy. The root cause is in httpd:check_header/3 , which rejects duplicate Content-Length headers but never validates the simultaneous presence o...
EUVD-2026-69235
httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...
CVE-2026-73812 inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...
CVE-2026-73812 inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...
CVE-2026-73812 inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...
EEF-CVE-2026-73812 inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
Summary httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired...
CVE-2026-71380 httpd applies no timeout while receiving a request body, parking a worker on a stalled client
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...
Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Request Smuggling.
Summary undici is used by IBM Storage Fusion Data Foundation, which could cause Request Smuggling. CVE-2026-1525, CVE-2026-1526, CVE-2026-1527, CVE-2026-1528, CVE-2026-2229. Vulnerability Details CVEID:CVE-2026-1525 DESCRIPTION: Undici allows duplicate HTTP Content-Length headers when they are...
CVE-2026-71562 httpc does not bound server-supplied numeric header values before integer conversion
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...
CVE-2026-71562 httpc does not bound server-supplied numeric header values before integer conversion
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...
CVE-2026-71562
Erlang/OTP inets httpc contains an improper validation flaw where server-supplied Content-Length and Retry-After header values are converted via unbounded list_to_integer/1 before size checks can apply. A malicious HTTP server can return a numeric header with up to roughly 1.26 million digits , c...
CVE-2026-71562 httpc does not bound server-supplied numeric header values before integer conversion
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...
