CVE-2026-77756

Apache Tomcat is vulnerable to an HTTP Request/Response Smuggling vulnerability due to the inconsistent interpretation of the transfer-encoding header for HTTP/1.0 requests. When positioned behind a reverse proxy, an attacker can exploit this to cause requests from other users to fail. This issue...

CVE-2026-77756

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse prox...

CVE-2026-77756 Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse prox...

EUVD-2026-85226

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse prox...

CVE-2026-77756 Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse prox...

HTTP Request/response Smuggling

Http4s is vulnerable to HTTP request/response smuggling. The vulnerability is due to Ember’s chunk decoder accepting malformed chunk-size values with leading plus or minus signs, which allows an attacker to exploit differences in chunk-boundary parsing by intermediaries to bypass controls, poison...

The vulnerability of the Goproxy proxy server’s HTTP request processing module allows attackers to bypass existing security mechanisms and gain unauthorized access to protected information.

The vulnerability of the Goproxy proxy server’s HTTP request processing module lies in the ability to bypass authentication by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to circumvent existing security mechanisms and gain unauthorized access to...

The vulnerability of the .NET software platform and the Visual Studio Code editor, related to deficiencies in HTTP request processing, allows attackers to disclose sensitive information.

The vulnerability of the .NET software platform and the code editor Visual Studio Code is related to deficiencies in HTTP request processing. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

CVE-2026-77756: Inconsistent Interpretation of HTTP Requests

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse prox...

CVE-2026-86350: Inconsistent Interpretation of HTTP Requests

Inconsistent interpretation of HTTP/2 requests 'HTTP Request/Response smuggling' vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from...

CVE-2025-63564

The Moodle Socialwall plugin versions v.3.0 through v.3.3 are affected by a SQL injection vulnerability. An attacker can exploit this flaw by sending crafted HTTP requests , which may lead to the execution of arbitrary code . The vulnerability is classified with a CRITICAL base severity score of ...

Security Bulletin: Vulnerabilities in WebSphere Liberty profile(CVE-2026-14525, CVE-2026-16192, CVE-2026-10571, CVE-2026-14976, CVE-2026-15280, CVE-2026-18499, CVE-2026-14980, CVE-2026-2482, CVE-2026-14529, CVE-2026-10841) affect Power PowerVM Novalink

Summary The WebSphere Liberty profile used by PowerVM Novalink. Novalink has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-10571 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure...

undertow-core: Undertow:HTTP request smuggling via oversized chunk-size bit overlap

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially...

undertow-core: Undertow:HTTP request smuggling via oversized chunk-size bit overlap

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially...

undertow-core: Undertow:HTTP request smuggling via oversized chunk-size bit overlap

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially...

undertow-core: Undertow:HTTP request smuggling via oversized chunk-size bit overlap

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially...

HTTP Request Smuggling

Http4s is vulnerable to HTTP request smuggling. The vulnerability is due to case-sensitive and charset-dependent parsing of the Transfer-Encoding header in Ember, which allows an attacker to exploit discrepancies between Ember and RFC-compliant intermediaries to bypass access controls, hijack...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: httpd (UTSA-2023-000282)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-000282 advisory. Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in modproxyajp of Apache HTTP Server allows an attacker to smuggle requests to th...

Comparative Evaluation of Static Embedding Models for HTTP Request Anomaly Detection

Web applications are increasingly targeted by cyberattacks that exploit HTTP requests to evade security mechanisms. Traditional web application firewalls WAFs rely on rule-based approaches that often exhibit high false positive rates and limited adaptability. Recent studies have explored machine...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: httpd (UTSA-2023-003827)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003827 advisory. Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request...