CVE-2026-84180

A flaw was found in Apache Camel's Knative component. When message processing fails, the Knative HTTP consumer returns detailed exception information, including class names, messages, and stack traces, directly in the response body to the caller. A remote attacker could exploit this flaw by sendi...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Go vulnerabilities (USN-8935-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8935-1 advisory. It was discovered that Go did not enforce a maximum recursion depth when parsing deeply nested ASN.1 structures. An attacker coul...

CVE-2026-78222

A flaw was found in NGINX. A remote attacker, by sending a specially crafted HTTP response to ngx.fetch, can cause an NGINX worker to crash when trusted JavaScript attempts to read the Response.statusText. This vulnerability requires the attacker to have control or influence over the fetched HTTP...

USN-8935-1 golang-1.22 vulnerabilities

It was discovered that Go did not enforce a maximum recursion depth when parsing deeply nested ASN.1 structures. An attacker could possibly use this issue to cause Go to crash, resulting in a denial of service. CVE-2026-33818 It was discovered that Go incorrectly reset the depth counter when...

USN-8935-1: Go vulnerabilities

It was discovered that Go did not enforce a maximum recursion depth when parsing deeply nested ASN.1 structures. An attacker could possibly use this issue to cause Go to crash, resulting in a denial of service. CVE-2026-33818 It was discovered that Go incorrectly reset the depth counter when...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Apache HTTP Server vulnerabilities (USN-8931-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8931-1 advisory. discovered that Apache HTTP Server exposed WebDAV property information. A remote...

Astra Linux – Vulnerability in JRuby

Before Ruby 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an HTTP Response Splitting attack was possible. An attacker could inject a crafted key and value into an HTTP response for the WEBrick HTTP server...

CVE-2026-110836

A flaw was found in FreeRDP. A remote attacker controlling a Remote Desktop gateway can cause a Denial of Service DoS by returning a crafted HTTP response containing an unrecognized Content-Type header with a semicolon and a nonzero Content-Length. This flaw triggers an infinite loop in the...

USN-8931-1 apache2 vulnerabilities

이지웅 discovered that Apache HTTP Server exposed WebDAV property information. A remote attacker could possibly use this issue to obtain sensitive information. CVE-2026-58415 Zhen Kong and Charles Vosburgh discovered that Apache HTTP Server did not properly validate FTP server responses. A remote...

USN-8931-1: Apache HTTP Server vulnerabilities

이지웅 discovered that Apache HTTP Server exposed WebDAV property information. A remote attacker could possibly use this issue to obtain sensitive information. CVE-2026-58415 Zhen Kong and Charles Vosburgh discovered that Apache HTTP Server did not properly validate FTP server responses. A remote...

SUSE CVE-2026-56449

Out-of-bounds Write vulnerability in Apache HTTP Server's modproxyhtml with crafted HTTP response bodies. This issue affects Apache HTTP Server version 2.4.68...

CVE-2026-85976

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query Console file-exploration endpoint, which could allow HTTP response splitting and unintended client-side response handling...

CVE-2026-85976

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are vulnerable to HTTP response splitting . The root cause is insufficient input sanitization within the Query Console file-exploration endpoint , which can lead to unintended client-side response handling . No specific ...

CVE-2026-85976 HTTP response splitting in Progress MarkLogic Server Query Console

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query Console file-exploration endpoint, which could allow HTTP response splitting and unintended client-side response handling...

EUVD-2026-97573

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query Console file-exploration endpoint, which could allow HTTP response splitting and unintended client-side response handling...

PT-2026-110813

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions 12.x prior to 12.1.0 Progress MarkLogic Server versions 11.x prior to 11.3.7 Description Insufficient sanitization of input used by the Query Console file-exploration endpoint allows for HTTP response...

CVE-2026-85976: Improper Neutralization of CRLF Sequences in HTTP Headers

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query Console file-exploration endpoint, which could allow HTTP response splitting and unintended client-side response handling...

crlfmap

CRLFMap CRLFMap es una herramienta para encontrar vulnerabilidades de división HTTP ¿Por qué? Quería escribir una herramienta en Golang para concurrencia Quería poder fuzzear tanto parámetros como rutas Instalación go get github.com/ryandamour/crlfmap Ayuda Comandos disponibles: help Ayuda sobre...

CLEANSTART-2026-RV47518 When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written

Security vulnerability affects the apache-nifi package. When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written...

Security Bulletin: Due to use of Apache Http Server, IBM Cloud Pak System is affected by HTTP Response splitting [CVE-2024-24795]

Summary HTTP Response splitting vulnerability has been identified in Apache HTTP Server. This vulnerability was addressed by IBM Cloud Pak System 2.3.6.2 Vulnerability Details CVEID:CVE-2024-24795 DESCRIPTION: HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker th...