HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in its HTTP/1.1 wire parser http/src/main/java/org/http4s/blaze/http/parser/, which carries five independent conformance laxities, notably in Content-Length handling relative to RFC 9110 section 8.6 and RFC 9112. ...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in its HTTP/1.1 wire parser http/src/main/java/org/http4s/blaze/http/parser/, which carries five independent conformance laxities, notably in Content-Length handling relative to RFC 9110 section 8.6 and RFC 9112. ...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Buinsess Automation Workflow (including Java)

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about security vulnerabilities affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security bulletins...

Astra Linux – Vulnerability in Twisted

In Twisted Web version 19.10.0, there was an HTTP request splitting vulnerability. When two content-length headers were provided, the system ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request...

Security Bulletin: Multiple vulnerabilities have been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository (CVE-2026-11710 etc.)

Summary WebSphere Application Server is shipped as a component of WebSphere Service Registry and Repository. Information about multiple vulnerabilities affecting WebSphere Application Server have been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in...

Astra Linux – Vulnerability in Gunicorn

Gunicorn fails to properly validate Transfer-Encoding headers, resulting in HTTP Request Smuggling HRS vulnerabilities. By creating requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue arises due to Gunicorn’s...

Astra Linux – Vulnerability in http-parser

Node.js versions before 10.23.1, 12.20.1, 14.15.4, and 15.5.1 allow for two copies of a header field in an HTTP request for example, two Transfer-Encoding header fields. In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling...

CVE-2026-90678

A flaw was found in HAProxy. A remote, unauthenticated attacker can exploit a vulnerability in the HTTP/3 multiplexer when processing requests without a Content-Length header, leading to HTTP request smuggling. This occurs when HAProxy is configured with QUIC support and an HTTP/3 frontend, and...

Security Bulletin: IBM MQ is affected by a vulnerability in IBM WebSphere Application Server Liberty (CVE-2026-11541)

Summary An HTTP request smuggling vulnerability was identified in IBM WebSphere Application Server Liberty, which IBM MQ ships and uses to supply IBM MQ Console and IBM MQ REST API functionality Vulnerability Details CVEID:CVE-2026-11541 DESCRIPTION: IBM CICS Transaction Gateway for Multiplatform...

Security Bulletin: IBM MQ is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty (CVE-2026-9320,CVE-2026-8646)

Summary Multiple issues were identified with IBM WebSphere Application Server Liberty, which IBM MQ ships and uses to supply IBM MQ Console and IBM MQ REST API functionality. Vulnerability Details CVEID:CVE-2026-9320 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere...

Security Bulletin: IBM MQ is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty (CVE-2026-50645,CVE-2026-9322,CVE-2026-9171)

Summary Multiple issues were identified with IBM WebSphere Application Server Liberty, which IBM MQ ships and uses to supply IBM MQ Console and IBM MQ REST API functionality. Vulnerability Details CVEID:CVE-2026-50645 DESCRIPTION: There is no restriction on the amount of attachment headers that a...

Security Bulletin: There is a vulnerability in IBM WebSphere Application Server Liberty used by IBM Maximo Manage application in IBM Maximo Application Suite

Summary Security Bulletin: There is a vulnerability in IBM WebSphere Application Server Liberty used by IBM Maximo Manage application in IBM Maximo Application Suite CVE-2026-3621,CVE-2026-8633,CVE-2026-8620,CVE-2026-10852,CVE-2026-8858,CVE-2026-9072,CVE-2026-11536, CVE-2026-9071 Vulnerability...

Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension

A flaw was found in Apache Tomcat. A remote attacker could exploit an inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, by sending a specially crafted request with an invalid chunk extension. This vulnerability allows an attacker to manipulate the way HTTP...

USN-8749-1: CivetWeb vulnerabilities

It was discovered that CivetWeb did not correctly handle parsing certain URIs. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. CVE-2025-55763 It was discovered that CivetWeb did...

CVE-2026-15634: Inconsistent Interpretation of HTTP Requests

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request...

CVE-2026-15396: Inconsistent Interpretation of HTTP Requests

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request...

ROS-20260914-73-0086

The vulnerability of the libyuv component in Google Chrome and Microsoft Edge is related to errors in HTTP requests processing. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

PT-2026-91448

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could...

PT-2026-91450

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server 9.0 IBM WebSphere Application Server 8.5 IBM WebSphere Application Server - Liberty affected versions not specified Description Improper parsing of the HTTP transfer-encoding request header allows for HTTP...

ROS-20260914-73-0128

The vulnerability of the Media component in Google Chrome and Microsoft Edge relates to errors in HTTP request processing. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...