CVE-2026-73812

httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...

Http11Probe

Http11Probe Http11Probe is a compliance and security tester for HTTP/1.1 servers. It throws malformed, ambiguous, and oversized requests at a server over raw TCP sockets and checks how it responds against what RFC 9110 and RFC 9112 actually require. These are the awkward cases like bare LF line...

CVE-2026-66752-HTTP-Request-Smuggling-via-Unparsed-Transfer-Encoding-Values-tiny_http-

Aviso de Seguridad: Contrabando de peticiones HTTP mediante valores Transfer-Encoding no analizados tinyhttp ID de CVE asignado: CVE-2026-66752 Resumen tinyhttp solo comprueba si hay una cabecera Transfer-Encoding. Nunca examina su valor. Cualquier valor, incluidos codings que no son chunked y...

heartbleed-lab

Heartbleed Lab Educational laboratory for studying the Heartbleed vulnerability CVE-2014-0160 using a real vulnerable OpenSSL environment inside Docker. This project reproduces a vulnerable TLS server using OpenSSL 1.0.1f and implements a custom raw TLS heartbeat client to demonstrate how malform...

mongobleed

MongoDB Compression Leak Lab Safe, Educational Reference CVE : CVE-2025-14847 This repository is an educational lab that demonstrates the concept behind a class of issues often described as “compression framing / size-metadata memory disclosure” in database wire protocols. It is written to suppor...

CVE-2022-24903-Heap-based-buffer-overflow-Hand-On-Lab

CVE-2022-24903 Hands-On Lab Author: Andrew Beshay Mousa A practical hands-on lab demonstrating the rsyslog heap buffer overflow vulnerability. A practical lab environment to reproduce and understand the rsyslog Heap Buffer Overflow vulnerability CVE-2022-24903 via octet-counted framing in TCP...

CVE-2026-47859 Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS

RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Spring Integration 7.1.0 Spring...

CVE-2026-47859

CVE-2026-47859 affects Spring Integration 's RFC6587SyslogDeserializer , the component used by the syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames. The root cause is that the deserializer trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array o...

flounder

configs/ - optionale Kontextprofile Diese JSON-Dateien sind optionale, antwortfreie Kontextprofile. Sie sind keine Flounder-Produktmodi und werden standardmäßig nicht geladen. Sie existieren für Fälle, in denen ein Operator dem Modell bewusst einen vertrauten Rahmen für eine Zielklasse geben...

Astra Linux – Vulnerability in Thunderbird

When an HTTPS page is embedded in an HTTP page, and a service worker is registered for the former, the service worker could intercept the request for the secure page. This occurs even though the iframe does not belong to a secure context due to the insecure framing. This vulnerability affects...

CVE-2026-63382

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

AZL-96900 CVE-2026-63382 affecting package libtevent 0.14.1-1

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

DEBIAN-CVE-2026-63382

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

EUVD-2026-63505

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

CVE-2026-63382 libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

CVE-2026-63382

CVE-2026-63382 is a critical (CVSS 4.0: 9.2) HTTP request smuggling vulnerability in Libevent 's evhttp parser (http.c). Three combined bugs—improper handling of duplicate Transfer-Encoding headers, missing validation for comma-separated values ending in chunked, and acceptance of bare LF chunk t...

CVE-2026-63382 libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

CVE-2026-63382

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

CVE-2026-63382 libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

cve-2026-47859 - MEDIUM - Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS

cve-2026-47859 - MEDIUM - Unbounded memory allocation in RFC6587SyslogDeserializer octet-counted framing — remote DoS...