CVE-2026-73232 ffuf denial of service (OOM) via HTTP response decompression bomb

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently...

CVE-2026-73232

CVE-2026-73232 affects ffuf (Go) prior to 2.2.0. The vulnerability arises when a malicious server uses HTTP responses with compressed content: the guard in pkg/runner/simple.go checks only Content-Length, while io.ReadAll can read gzip, brotli, deflate, or chunked bodies without a decompressed-si...

CVE-2026-73232 ffuf denial of service (OOM) via HTTP response decompression bomb

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently...

netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion

A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses 103, followed by a 200 with a GET body, then another 200 for a HEAD request when the client pipelines GET the...

netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion

A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses 103, followed by a 200 with a GET body, then another 200 for a HEAD request when the client pipelines GET the...

Fedora 43 : nghttp2 (2026-91dd0c29d6)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-91dd0c29d6 advisory. - fix HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 Tenable has extracted the preceding...

CVE-2026-72579 NASA HyperCP - OS Command Injection via Malicious HTTP Response from Data Server

An OS command injection vulnerability in NASA HyperCP main branch allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov to execute arbitrary system commands on the researcher's workstation...

send v4.1.1

@fastify/send Send is a library for streaming files from the file system as an HTTP response supporting partial responses Ranges, conditional-GET negotiation If-Match, If-Unmodified-Since, If-None-Match, If-Modified-Since, high test coverage, and granular events which may be leveraged to take...

CVE-2026-12071

The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” representing a dot, an attacker can manipulate the portion of the URL following the...

PT-2026-68893

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The Webbox component constructs redirect URLs using user-supplied input appended to the redirect target in a 302 HTTP response. An attacker can use URL-encoded characters, such as %2e...

CVE-2026-12071: URL Redirection to Untrusted Site

The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” representing a dot, an attacker can manipulate the portion of the URL following the...

EulerOS 2.0 SP15 : httpd (EulerOS-SA-2026-2888)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A NULL pointer dereference in moddavlock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious...

ALSA-2026:50317 Important: fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fixes: httplib2: httplib2: Denial of Service via unbounded decompression of HT...

CVE-2026-10849 Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body

The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in responsejsoncb subsys/mgmt/hawkbit/hawkbit.c. The buffer is sized to hold the received body bytes but reserves no space for a terminating NUL. When the...

CVE-2026-10849 Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body

The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in responsejsoncb subsys/mgmt/hawkbit/hawkbit.c. The buffer is sized to hold the received body bytes but reserves no space for a terminating NUL. When the...

CVE-2026-67297

FreeRDP before 3.29.0 fails to enforce the RESPONSESIZELIMIT when processing Transfer-Encoding: chunked HTTP responses in httpresponserecvbody. Attackers controlling a malicious RD Gateway endpoint can send oversized chunked response bodies to exhaust client memory resources without triggering th...

CVE-2026-67297

FreeRDP prior to 3.29.0 contains a flaw in http_response_recv_body() where RESPONSE_SIZE_LIMIT is not enforced for Transfer-Encoding: chunked HTTP responses. This allows an attacker controlling a malicious RD Gateway endpoint to send oversized chunked bodies, exhausting memory on the client. Impa...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by multiple vulnerabilities

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is affected by a denial of service, HTTP Response and Request Smuggling vulnerabilities when servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 is enabled. Vulnerability Details...

SUSE CVE-2026-39882

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters traces/metrics/logs read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...

IBM WebSphere Application Server Input Validation Vulnerability (CNVD-2026-31548)

IBM WebSphere Application Server is an application server product developed by IBM. There is a security vulnerability in IBM WebSphere Application Server, which stems from improper handling of HTTP version tokens. Attackers can exploit this vulnerability to perform HTTP response smuggling attacks...