CVE-2026-66753-HTTP-Header-Injection-via-Unvalidated-CR-and-LF-in-Header-Values-tiny_http-

Security Advisory: HTTP Header Injection via Unvalidated CR and LF in Header Values tinyhttp Assigned CVE ID: CVE-2026-66753 Summary tinyhttp does not reject carriage return or line feed inside HTTP header values, in either direction. On the request side, readnextline ends a header line only on...

log4jcheck

Northwave Log4j CVE-2021-44228 checker Friday 10 December 2021 a new Proof-of-Concept 1 addressing a Remote code Execution RCE vulnerability in the Java library 'log4j' 2 was published. This vulnerability has not been disclosed to the developers of the software upfront. The vulnerability is being...

CVE-2026-Mastodon-Streaming-CRLF-Injection

CVE-2026-XXXXX: HTTP Response Header Injection CRLF in Mastodon Streaming Server Vulnerability Overview Item| Details ---|--- CVE ID| CVE-2026-XXXXX Affected Product| Mastodon Streaming Server Affected Version| $key: $headerskey.join' ' ; Impact HTTP Header Injection: Inject ar...

nextjs-middleware-auth-bypass-lab

Next.js Middleware Authorization Bypass CVE-2025-29927 What Is the Vulnerability? In Next.js applications, middleware runs before requests reach the application, performing checks such as authentication and authorization. In CVE-2025-29927, due to the specially added x-middleware-subrequest HTTP...

CVE-2017-5638

CVE-2017-5638 This script is intended to validate Apache Struts 2 vulnerability CVE-2017-5638, AKA Struts-Shock. This is a completely harmless as it does not inject any malicious payload, only inject an HTTP header named 'STRUTS2-VALIDATION' in order to be able to validate whether is vulnerable...

CVE-2017-5638

CVE-2017-5638 This script is intended to validate Apache Struts 2 vulnerability CVE-2017-5638, AKA Struts-Shock. This is a completely harmless as it does not inject any malicious payload, only inject an HTTP header named 'STRUTS2-VALIDATION' in order to be able to validate whether is vulnerable...

EUVD-2026-123054

Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header on regex Routes, allowing HTTP header injection and request smuggling to the upstream...

CVE-2026-92441

Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header on regex Routes, allowing HTTP header injection and request smuggling to the upstream...

CVE-2026-92441

Kong Gateway Enterprise and Kong AI Gateway are vulnerable to HTTP header injection and request smuggling because they include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header when using regex Routes . The root cause is the improper neutralization of CRLF sequences ...

CVE-2026-92441

Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header on regex Routes, allowing HTTP header injection and request smuggling to the upstream...

EUVD-2026-120519

KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability that may allow arbitrary HTTP headers to be injected into the HTTP response when a user accesses a specially crafted URL...

CVE-2026-117477

KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability that may allow arbitrary HTTP headers to be injected into the HTTP response when a user accesses a specially crafted URL...

CVE-2026-117477: GMO Prime Strategy Co., Ltd.: KUSANAGI provided by GMO Prime Strategy Co., Ltd

KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability that may allow arbitrary HTTP headers to be injected into the HTTP response when a user accesses a specially crafted URL...

CVE-2026-92441: Kong Inc.: Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the…

Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header on regex Routes, allowing HTTP header injection and request smuggling to the upstream...

PT-2026-144831

Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header on regex Routes, allowing HTTP header injection and request smuggling to the upstream...

CVE-2026-117477

The KUSANAGI software (provided by GMO Prime Strategy Co., Ltd.) is vulnerable to an HTTP header injection due to a CRLF injection flaw within a redirect rule. This flaw occurs when the software writes to the Nginx configuration of WordPress profiles, allowing an attacker to inject arbitrary HTTP...

CVE-2026-117477

KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability that may allow arbitrary HTTP headers to be injected into the HTTP response when a user accesses a specially crafted URL...

CVE-2025-60876

CVE-2025-60876: busybox wget request-target injection fix A behavior-preserving fix for CVE-2025-60876, an HTTP header-injection vulnerability in BusyBox wget, plus the proof-of-concept that demonstrates it and the artifacts for submitting the fix upstream to BusyBox. The vulnerability BusyBox wg...

PT-2026-141176

Name of the Vulnerable Software and Affected Versions KUSANAGI versions 9.12.2-1 and earlier Free, Business, and Premium editions KUSANAGI versions 10.7.2-1 and earlier Security and Enterprise editions KUSANAGI versions 7 and 8 Description An HTTP header injection flaw exists due to a CRLF Carria...

SUSE CVE-2026-120639

CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipartstart and dopush. With autoEscape off, header decodes HTML entities in extra header values after its newline check, so an encoded CR or LF reaches t...