Design/Logic Flaw

HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than requir...

CVE-2023-24534 Excessive memory allocation in net/http and net/textproto

HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than requir...

Google Golang 资源管理错误漏洞

Google Golang is a static, strongly typed, compiled language from Google.The syntax of Go is close to C, but with differences in variable declarations.Go supports garbage collection.Go's parallel model is based on Tony Hall's Communicating Sequential Processes CSP, and other languages with a...

CBL Mariner 2.0 Security Update: python-twisted (CVE-2022-24801)

The version of python-twisted installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-24801 advisory. - Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to...

@akumzy/graphql-schema-generator (>=0.2.0, <=0.5.1), @appxdigital/appx-core (0.1.83) +522 more potentially affected by CVE-2023-24807 via undici (>=5.0.0, <=5.18.0)

undici NPM version =5.0.0, =0.2.0, =0.2.1, =0.2.11, =4.0.0-alpha.4, =2.0.0, =1.6.0, =1.0.0, =0.0.4, =0.2.0-beta.0, =0.2.0-beta.20 and more Source cves: CVE-2023-24807 Source advisory: OSV:GHSA-R6CH-MQF9-QC9W...

SUSE CVE-2018-4013

An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server library version 0.92. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability...

SUSE CVE-2019-15892

An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Servic...

acme-dns-rust (>=1.0.0, <=1.0.6), acme2-slim (0.2.0) +163 more potentially affected by unknown CVE via warp (>=0.1.23, <=0.3.1)

warp CARGO version =0.1.23, =1.0.0, =0.1.0, =0.1.0, =0.1.5, =0.1.0, =1.0.0, =0.14.0, =0.4.0, =0.1.0, =0.1.0, =0.1.6 and more Source cves: unknown CVE Source advisory: OSV:GHSA-8V4J-7JGF-5RG9...

CVE-2023-21538

A vulnerability was found in dotnet. This flaw occurs when parsing an empty HTTP response as a JSON.NET JObject that causes a stack overflow and crashes a process...

CVE-2022-24910

A buffer overflow vulnerability exists in the httpd parsepingresult API functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted file can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability...

@mattie-bundle/mattie-strapi-bundle-example (>=1.0.0-alpha.0, <=1.0.0-alpha.3), strapi-ent-a (0.1.0) +1 more potentially affected by CVE-2021-46440 via @strapi/strapi (>=4.0.0-beta.0, <=4.1.2)

@strapi/strapi NPM version =4.0.0-beta.0, =1.0.0-alpha.0, =1.0.0-alpha.3 - strapi-ent-a 0.1.0 - sveltekit-strapi 0.1.0 Source cves: CVE-2021-46440 Source advisory: OSV:GHSA-85VG-GRR5-PW42...

Cisco Adaptive Security Appliances Software 缓冲区错误漏洞

Cisco Adaptive Security Appliances Software is a set of firewalls and network security platforms from the U.S. company Cisco Cisco. The platform provides highly secure access to data and network resources and other features. A buffer overflow vulnerability exists in the Cisco Adaptive Security...

UBUNTU-CVE-2022-24761

Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly validate the incoming HTTP request matches the RFC7230 standard, Waitress and the frontend proxy may disagree on where one request starts and...

U.S. Dept Of Defense: HTTP Request Smuggling

hello dear support I have found HTTP Request Smuggling on www.████████ Issue description ============== HTTP request smuggling vulnerabilities arise when websites route HTTP requests through webservers with inconsistent HTTP parsing. By supplying a request that gets interpreted as being different...

amiwo (>=0.0.1, <=0.2.3), geoshaper (>=0.1.0, <=0.2.0) +8 more potentially affected by CVE-2021-29935 via rocket (>=0.1.6, <=0.2.11)

rocket CARGO version =0.1.6, =0.0.1, =0.1.0, =0.8.0, =0.15.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1 Source cves: CVE-2021-29935 Source advisory: OSV:RUSTSEC-2021-0044...

USN-4558-1: libapreq2 vulnerabilities

It was discovered that libapreq2 did not properly sanitize the Content-Type field in certain, crafted HTTP requests. An attacker could use this vulnerability to cause libapreq2 to crash...

@commercial/hapi (19.0.2), @hapi/hapi (>=19.0.0, <=19.0.4) +7 more potentially affected by unknown CVE via @hapi/accept (4.0.1)

@hapi/accept NPM version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/accept and may be impacted: - @commercial/hapi 19.0.2 - @hapi/hapi =19.0.0, =0.0.3, =0.27.0, =0.27.0, =0.9.0, =2.0.4, =5.0.2 Source cves: unknown CVE Source advisory:...

abrute (>=0.1.7, <=0.1.9), anterofit (>=0.0.1, <=0.0.2) +18 more potentially affected by CVE-2020-35884 via tiny_http (>=0.4.1, <=0.5.9)

tinyhttp CARGO version =0.4.1, =0.1.7, =0.0.1, =0.0.1, =0.1.0, =0.1.1, =0.1.1, =0.1.0, =0.5.0-alpha.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.5.0 and more Source cves: CVE-2020-35884 Source advisory: OSV:RUSTSEC-2020-0031...

Microsoft Edge Spoofing Vulnerability (CNVD-2020-61594)

Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. A security vulnerability exists in Microsoft Edge, which stems from the program's failure to properly parse HTTP content. An attacker could exploit the vulnerability to lure users by...

FreeBSD : Node.js -- multiple vulnerabilities (0032400f-624f-11ea-b495-000d3ab229d6)

Node.js reports : Updates are now available for all active Node.js release lines for the following issues. HTTP request smuggling using malformed Transfer-Encoding header Critical CVE-2019-15605HTTP request smuggling using malformed Transfer-Encoding header Critical CVE-2019-15605 Affected Node.j...