smugglefuzz

SmuggleFuzz SmuggleFuzz, un escáner de contrabando de degradación HTTP configurable y rápido. Permite a los usuarios personalizar listas de gadgets, ofreciendo una comprensión más profunda de las razones detrás de los fallos en ataques de contrabando. Estoy convencido de que numerosas...

Apache Tomcat - HTTP Request Smuggling

Apache Tomcat from versions 8.5.0 to 8.5.93, 9.0.0-M1 to 9.0.81, 10.1.0-M1 to 10.1.13, and 11.0.0-M1 to 11.0.0-M11 contain an improper input validation caused by incorrect parsing of HTTP trailer headers, letting attackers craft headers to cause request smuggling, exploit requires sending malicio...

CVE-2021-40346-POC

CVE-2021-40346-POC CVE-2021-40346 desbordamiento de enteros permite contrabando HTTP Desbordamiento de enteros que permite contrabando HTTP Análisis en chino: Análisis de la vulnerabilidad de contrabando de solicitudes de HAProxy CVE-2021-40346 Referencia:...

CVE-2021-40346

CVE-2021-40346 CVE-2021-40346 PoC HAProxy HTTP Smuggling Solo con fines educativos Configuración $ docker build -t cve-2021-40346 . $ docker run --name poc -p 8000:80 -d --rm -it cve-2021-40346 4941e9f23508b497e4cbe334a75e7cdb84c83478522ed85f48db3477f97a6fb4 Prueba Confirma que /admin está...

BurpSuiteHTTPSmuggler

Burp Suite HTTP Smuggler Una extensión de Burp Suite para ayudar a los pentesters a evadir WAFs o probar su efectividad mediante una serie de técnicas. Esta extensión ha sido desarrollada por Soroush Dalili @irsdl de NCC Group. La versión inicial v0.1 solo admite la capacidad de Encoding, que pue...

CVE-2019-20372

CVE-2019-20372 Este repositorio es únicamente con fines educativos. /server Servidor vulnerable, ejecutar ./server.sh /exploit.py Script de explotación, ejecutar python3 exploit.py importante! https://blkcipher.pl/assets/pdfs/2019-12-10-errorpagerequestsmuggling.pdf...

CVE-2021-3064

CVE-2021-3064: Desbordamiento de búfer remoto en Pan-OS + Contrabando HTTP Exploit Este exploit utiliza una vulnerabilidad de contrabando HTTP para entregar un payload a un endpoint que de otro modo sería inaccesible en firewalls Pan-OS; el endpoint es vulnerable a un desbordamiento que puede ser...

node-poc-http-smuggling

Este repositorio no tiene un README...

Security Bulletin: IBM Watson Explorer is affected by a vulnerability in IBM WebSphere Application Server Liberty

Summary IBM Watson Explorer contains a vulnerable version of IBM WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2026-14981 DESCRIPTION: IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the...

CVE-2026-82672

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent requests that...

EEF-CVE-2026-82672 Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections

Summary Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent request...

EUVD-2026-83608

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent requests that...

[SECURITY] [DLA 4786-1] libevent security update

Debian LTS Advisory DLA-4786-1 [email protected] https://www.debian.org/lts/security/ Andreans Henriksson September 18, 2026 https://wiki.debian.org/LTS Package : libevent Version : 2.1.12-stable-8+deb12u1 CVE ID : CVE-2026-63379 CVE-2026-63381 CVE-2026-63382 CVE-2026-63383 CVE-2026-633...

EulerOS Virtualization 2.12.1 : nghttp2 (EulerOS-SA-2026-3601)

According to the versions of the nghttp2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body ont...

Debian dla-4786 : libevent-2.1-7 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4786 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4786-1 [email protected]...

libevent security update

2.1.8-11 - Fix CVE-2026-63385: HTTP header injection via CRLF in header values - Resolves: RHEL-253566 2.1.8-10 - Fix CVE-2026-63387: out-of-bounds write in evdns dnsnametolabels - Resolves: RHEL-249889 2.1.8-9 - Fix CVE-2026-63383: out-of-bounds read in decodetaginternal - Resolves: RHEL-250240...

EUVD-2023-60690

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain...

Astra Linux – Vulnerability in HAPProxy

There is an integer overflow in HAProxy versions 2.0 to 2.5, specifically in the htxaddheader function, which can be exploited to perform an HTTP request smuggling attack. This allows an attacker to bypass all configured http-request HAProxy Access Control Lists and possibly other access control...

Astra Linux – Vulnerability in Netty

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace such as a spaceTransfer-Encoding:chunked line and a later Content-Length header. This issue exists due to an incomplete fix for CVE-2019-16869...

Security Bulletin: IBM MQ is affected by a vulnerability in IBM WebSphere Application Server Liberty (CVE-2026-11806)

Summary An arbitrary file read vulnerability was identified in IBM WebSphere Application Server Liberty, which IBM MQ ships and uses to supply IBM MQ Console and IBM MQ REST API functionality Vulnerability Details CVEID:CVE-2026-11806 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0...