1120 matches found
CVE-2026-111753
The @angular/common package's HttpClient function xsrfInterceptorFn is vulnerable to XSRF token leakage due to a URL parsing discrepancy between a regular expression and the browser's WHATWG URL parser . Because the regex does not normalize certain characters—such as backslashes, control characte...
CVE-2026-123119
The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private network restrictions, resulting in enumeration of internal hosts and ports in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x...
CVE-2026-123119
The Symfony HttpClient component's NoPrivateNetworkHttpClient is vulnerable to DNS rebinding because it fails to pin the checked IP address for cached hosts. While the component correctly checks the IP on the first lookup, subsequent requests allow the decorated client to perform its own resoluti...
CVE-2026-123119 Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)
The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private network restrictions, resulting in enumeration of internal hosts and ports in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x...
EUVD-2026-117435
The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private network restrictions, resulting in enumeration of internal hosts and ports in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x...
CVE-2026-121971
The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope such as authbearer or authbasic into a request before resolving a relative URL against the baseuri, allowing a network-path reference such as "//evil.example/steal" to be sent to another origin together...
CVE-2026-121971 Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References
The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope such as authbearer or authbasic into a request before resolving a relative URL against the baseuri, allowing a network-path reference such as "//evil.example/steal" to be sent to another origin together...
EUVD-2026-117008
The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope such as authbearer or authbasic into a request before resolving a relative URL against the baseuri, allowing a network-path reference such as "//evil.example/steal" to be sent to another origin together...
CVE-2026-121971 Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References
The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope such as authbearer or authbasic into a request before resolving a relative URL against the baseuri, allowing a network-path reference such as "//evil.example/steal" to be sent to another origin together...
CVE-2026-121971
The ScopingHttpClient component in Symfony HttpClient is vulnerable to a credential disclosure flaw. The application incorrectly merges default scope options (such as auth_bearer or auth_basic ) into a request before resolving a relative URL against a base_uri . This allows a network-path referen...
CVE-2026-121971: Exposure of Sensitive Information
The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope such as authbearer or authbasic into a request before resolving a relative URL against the baseuri, allowing a network-path reference such as "//evil.example/steal" to be sent to another origin together...
CVE-2026-121971
The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope such as authbearer or authbasic into a request before resolving a relative URL against the baseuri, allowing a network-path reference such as "//evil.example/steal" to be sent to another origin together...
PT-2026-137071
The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope such as auth bearer or auth basic into a request before resolving a relative URL against the base uri, allowing a network-path reference such as "//evil.example/steal" to be sent to another origin togeth...
ROOT-APP-RUBY-AIKIDO-2026-932465 AIKIDO-2026-932465 in httpclient - Patched by Root
Root has patched AIKIDO-2026-932465 in the httpclient package for Root:Ruby. Multiple fixed versions available...
CLEANSTART-2026-GI03185 HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...
Security vulnerability affects the druid-fips package. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message...
CLEANSTART-2026-IW87835 HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...
Security vulnerability affects the cassandra-reaper-fips package. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message...
CLEANSTART-2026-AF18461 HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...
CVE-2026-64607 affects multiple packages. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. See references for individual...
CLEANSTART-2026-RO05755 Apache HttpClient versions prior to version 4
Security vulnerability affects the apache-hive package. Apache HttpClient versions prior to version 4...
CLEANSTART-2026-RC74250 HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...
CVE-2026-64607 affects multiple packages. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. See references for individual...
Security Bulletin: Multiple Security Vulnerabilities in HttpClient affect IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-64607, CVE-2026-71290)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed these security vulnerabilities Vulnerability Details CVEID:CVE-2026-64607 DESCRIPTION: HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if ...