20328 matches found
CVE-2026-93566 Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can le...
EUVD-2026-82935
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can le...
CVE-2026-93566 Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can le...
EUVD-2026-82862
A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...
Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by an HTTP request smuggling vulnerability
Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is affected by an HTTP request smuggling vulnerability CVE-2026-11710 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected...
Tenda HG3 formTracert() Code Execution
The vulnerability of the formTracert function in Tenda HG3 router microprogramming software is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code by sending a specially crafted HTTP request...
PT-2026-95401
Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description An issue exists where strict validation of the chunk-size line is skipped when the line contains no chunk extension ;. A remote attacker can exploit this by sending a specially crafted HTTP...
PT-2026-95698
Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A flaw in the netty-codec-http component allows a remote attacker to perform HTTP request smuggling. This occurs due to incorrect parsing of the HTTP/1.1 chunk-size token when it contains...
EulerOS 2.0 SP15 : libsoup (EulerOS-SA-2026-3785)
According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soupbodyinputstreamreadchunked functio...
Oracle Linux 8 : libevent (ELSA-2026-67908)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-67908 advisory. - Fix CVE-2026-63385: HTTP header injection via CRLF in header values - Fix CVE-2026-63387: out-of-bounds write in evdns dnsnametolabels - Fix...
PT-2026-95423
Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A flaw in the HTTP/1.1 decoder allows a remote attacker to bypass Transfer-Encoding header validation. By splitting the Transfer-Encoding field across multiple headers and ensuring the last fie...
CVE-2026-93574: Inconsistent Interpretation of HTTP Requests
A flaw was found in Netty's netty-codec-http component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an...
CVE-2026-11722: Inconsistent Interpretation of HTTP Requests
IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability...
CVE-2026-93573: Inconsistent Interpretation of HTTP Requests
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass Transfer-Encoding header validation by splitting the Transfer-Encoding field across multiple headers, with the last field containing a non-final transfer coding like gzip or deflate. This bypass ca...
CVE-2026-93566: Undefined Security Weakness
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can le...
CVE-2026-10841: Inconsistent Interpretation of HTTP Requests
IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling...
CVE-2026-93562: Undefined Security Weakness
A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls ...
CVE-2026-11710: Inconsistent Interpretation of HTTP Requests
IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers...
CVE-2026-11548: Inconsistent Interpretation of HTTP Requests
IBM WebSphere Application Server 8.5 and 9.0, and and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability...