136176 matches found
BIT-RABBITMQ-2026-67218 RabbitMQ: Super-stream HTTP creation skips configure-permission check
RabbitMQ is a messaging and streaming broker. Prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0, acceptcontent/2 at line 56 calls rabbitstreammanager:createsuperstream/... directly after isauthorized which only checks the management tag + vhost access via isauthorizedvhost. The stream-protocol...
BIT-LIBPHP-2026-93682 Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server...
BIT-LIBPHP-2026-91766 Cross-origin credential leak in HTTP stream wrapper redirects
When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore...
BIT-LIBPHP-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...
CLEANSTART-2024-QY49734 libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and HTTP protocols
Security vulnerability affects the apk-tools package. libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and HTTP protocols...
CLEANSTART-2026-HC06922 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0
Security vulnerability affects the exoscale package. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...
Prototype Pollution
Axios is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of inherited Object.prototype.headers during request configuration normalization, which allows an attacker with a separate prototype-pollution capability to inject attacker-controlled HTTP headers, including...
CLEANSTART-2025-MG51423 HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023
CVE-2023-44487 affects multiple packages. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. See references for individual vulnerability details...
CLEANSTART-2026-CN84558 attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames
Security vulnerability affects the cri-tools package. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames...
CLEANSTART-2026-PP37381 net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines
Security vulnerability affects the cri-tools package. The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines...
CLEANSTART-2026-HM31104 HTTP client drops sensitive headers after following a cross-domain redirect
Security vulnerability affects the cri-tools package. The HTTP client drops sensitive headers after following a cross-domain redirect...
CLEANSTART-2024-OB04829 In net/http in Go before 1
Security vulnerability affects the docker-cli-compose package. In net/http in Go before 1...
ROOT-APP-MAVEN-CVE-2026-50020 CVE-2026-50020 in io.netty:netty-codec-http - Patched by Root
Root has patched CVE-2026-50020 in the io.netty:netty-codec-http package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-55831 CVE-2026-55831 in io.netty:netty-codec-http - Patched by Root
Root has patched CVE-2026-55831 in the io.netty:netty-codec-http package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-56745 CVE-2026-56745 in io.netty:netty-codec-http - Patched by Root
Root has patched CVE-2026-56745 in the io.netty:netty-codec-http package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-41417 CVE-2026-41417 in io.netty:netty-codec-http - Patched by Root
Root has patched CVE-2026-41417 in the io.netty:netty-codec-http package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-33870 CVE-2026-33870 in io.netty:netty-codec-http - Patched by Root
Root has patched CVE-2026-33870 in the io.netty:netty-codec-http package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-42584 CVE-2026-42584 in io.netty:netty-codec-http - Patched by Root
Root has patched CVE-2026-42584 in the io.netty:netty-codec-http package for Root:Maven. Multiple fixed versions available...