CVE-2026-66753-HTTP-Header-Injection-via-Unvalidated-CR-and-LF-in-Header-Values-tiny_http-

Уведомление об уязвимости: внедрение в HTTP-заголовки через непроверенные CR и LF в значениях заголовков tinyhttp Присвоенный идентификатор CVE: CVE-2026-66753 Краткое описание tinyhttp не отклоняет символы возврата каретки CR и перевода строки LF внутри значений HTTP-заголовков в обоих...

nextjs-middleware-auth-bypass-lab

Next.js Middleware Authorization Bypass CVE-2025-29927 취약점이란? Next.js 애플리케이션에서 미들웨어는 요청이 애플리케이션에 도달하기 전에 실행되어 인증 및 권한 부여와 같은 검사를 수행합니다. CVE-2025-29927 취약점에서는 특별히 추가된 x-middleware-subrequest HTTP 헤더로 인해 미들웨어가 특정 상황에서 요청을 검증된 것으로 간주할 수 있습니다. 이로 인해 권한이 없는 사용자가 보호된 페이지에 접근할 수 있게 됩니다. 프로젝트 소개 이 프로젝트에서...

CVE-2026-Mastodon-Streaming-CRLF-Injection

CVE-2026-XXXXX: Mastodon Streaming Server의 HTTP 응답 헤더 인젝션 CRLF 취약점 개요 항목| 내용 ---|--- CVE ID| CVE-2026-XXXXX 영향을 받는 제품| Mastodon Streaming Server 영향을 받는 버전| $key: $headerskey.join' ' ; 영향 HTTP 헤더 인젝션: 임의의 HTTP 헤더 주입 HTTP 응답 분할: 두 번째 HTTP 응답 본문 주입 캐시 포이즈닝 정보 노출: 내부 오류 메시지가 인증되지 않은 사용자에게 노출됨 개념 증명...

CVE-2017-5638

CVE-2017-5638 이 스크립트는 Apache Struts 2 취약점CVE-2017-5638, 일명 Struts-Shock을 검증하기 위한 것입니다. 악성 페이로드를 주입하지 않고 오직 'STRUTS2-VALIDATION'이라는 HTTP 헤더만 주입하여 취약한지 여부를 검증할 수 있으므로 완전히 무해합니다. 멀티스레드 기능 덕분에 전 세계에 분산된 2.5k개 이상의 애플리케이션을 10분 이내에 실행할 수 있습니다. 따라서 대규모 엔터프라이즈 애플리케이션을 검증하는 데 매우 유용합니다. cve-2017-5638...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.16 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.1 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...

netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.19 Update

An update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability scoring System CVSS base score, which gives a detailed severity rating, ...

Rocky Linux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779886202)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779886202 advisory. - When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Pat...

CVE-2025-60876

CVE-2025-60876: Correction de l'injection request-target dans busybox wget Un correctif préservant le comportement pour CVE-2025-60876, une vulnérabilité d'injection d'en-tête HTTP dans BusyBox wget, ainsi que la preuve de concept qui la démontre et les artefacts pour soumettre le correctif en...

CVE-2026-101900

A flaw was found in Axios. This vulnerability allows an attacker to manipulate outbound network traffic by injecting arbitrary HTTP Hypertext Transfer Protocol headers. In environments where an attacker can exploit a separate prototype pollution flaw to modify shared object properties, the Axios...

CVE-2017-5638

CVE-2017-5638 Ce script est conçu pour valider la vulnérabilité Apache Struts 2 CVE-2017-5638, également connue sous le nom de Struts-Shock. Il est totalement inoffensif car il n'injecte aucune charge utile malveillante, seulement un en-tête HTTP nommé 'STRUTS2-VALIDATION' afin de pouvoir valider...

log4jcheck

Vérificateur Northwave Log4j CVE-2021-44228 Le vendredi 10 décembre 2021, une nouvelle preuve de concept 1 traitant d'une vulnérabilité d'exécution de code à distance RCE dans la bibliothèque Java 'log4j' 2 a été publiée. Cette vulnérabilité n'a pas été divulguée aux développeurs du logiciel au...

netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...

Oracle Linux 8 : libevent (ELSA-2026-67908)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-67908 advisory. - Fix CVE-2026-63385: HTTP header injection via CRLF in header values - Fix CVE-2026-63387: out-of-bounds write in evdns dnsnametolabels - Fix...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : libsoup vulnerabilities (USN-8780-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8780-1 advisory. It was discovered that libsoup incorrectly...

NewStart CGSL MAIN 7.02 : busybox Multiple Vulnerabilities (NS-SA-2026-0087)

The remote NewStart CGSL host, running version MAIN 7.02, has busybox packages installed that are affected by multiple vulnerabilities: - BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-0865 DESCRIPTION: User-controlled header names and values containing newlines can allow injecting HTTP headers. CWE:CWE-74: Improper Neutralization of...

SUSE-SU-2026:3930-1 Security update for nodejs20

This update for nodejs20 fixes the following issues: - CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request bsc1236258. - CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response...

SUSE-SU-2026:3929-1 Security update for nodejs20

This update for nodejs20 fixes the following issues: - CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request bsc1236258. - CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response...