RockyLinux 10 : tomcat9 (RLSA-2026:25341)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:25341 advisory. tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 tomcat: Client certificate verification...

CVE-2021-40346

CVE-2021-40346: HAProxy HTTPリクエストスマグリング - ACLバイパス 概要 このプロジェクトは、HAProxyにおける重大な整数オーバーフロー脆弱性 CVE-2021-40346 を実証し、HTTPリクエストスマグリング攻撃によりセキュリティ制御を回避する方法を示します。 CVSSv3スコア: 7.5（高） 貢献者: 1. Boian Eduard 2. Borsos Matheas-Roland CVE-2021-40346 とは？ CVE-2021-40346 は、HAProxy の HTTP ヘッダー解析ロジックにおける 整数オーバーフロー脆弱性...

SAPGateBreaker-Exploit

CVE-2022-22536: SAPのフロントドアを通じたHTTPスマグリング SAP NetWeaver Application Server ABAP、SAP NetWeaver Application Server Java、ABAP Platform、SAP Content Server 7.53、SAP Web...

CVE-2026-88773 HTTP Request Smuggling

Inconsistent interpretation of HTTP requests 'HTTP Request/Response smuggling' vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIP...

CVE-2026-88773

CVE-2026-88773 involves an HTTP request smuggling vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway . The flaw affects appliances with load balancing, content switching, VPN, or authentication virtual servers of type HTTP or SSL. Impacted versions include ADC before 14.1-73.37, 1...

CVE-2026-88773 HTTP Request Smuggling

Inconsistent interpretation of HTTP requests 'HTTP Request/Response smuggling' vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIP...

NetScaler ADC and NetScaler Gateway 13.1 < 13.1-64.23 / 14.1 < 14.1-73.37 Multiple Vulnerabilities

The remote NetScaler ADC formerly Citrix ADC or NetScaler Gateway formerly Citrix Gateway device is version 13.1 prior to 13.1-64.23, 14.1 prior to 14.1-73.37, 13.1-FIPS/NDcPP prior to 13.1-37.279, or 14.1-FIPS prior to 14.1-73.37. It is, therefore, affected by multiple vulnerabilities: - A remot...

Linux Distros Unpatched Vulnerability : CVE-2026-100666

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in its HTTP/3 request header handling, which does not enforce the RFC 9114 section 4.3.1 requirement that an :authority pseudo-header and a literal host header field carry the same value when both are present. An...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in HttpConversionUtil.toHttp3HeadersHttpMessage, boolean, which has no special case for HTTP/1 CONNECT and instead runs the generic request conversion, drawing :authority from the Host header rather than the...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in HttpConversionUtil.toHttp3HeadersHttpMessage, boolean, reached through Http3FrameToHttpObjectCodecfalse, which processes the Host header before the authority carried in an absolute-form request-target, so a...

HTTP Request Smuggling

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to HTTP Request Smuggling in the isContentAlwaysEmpty method of HttpServerCodec, which calls...

Qlik Sense Enterprise - HTTP Request Smuggling

An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunnelin...

OESA-2026-4037 python-tornado security update

Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived...

OESA-2026-4035 python-tornado security update

Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived...

OESA-2026-4036 python-tornado security update

Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived...

OESA-2026-4034 python-tornado security update

Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libevent (UTSA-2026-124537)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124537 advisory. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding...

Linux Distros Unpatched Vulnerability : CVE-2026-77756

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header...

SUSE CVE-2026-93562

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls ...