CVE-2025-0108

CVE-2025-0108 — WebSecurity PoC & Fix This repository contains a small lab environment for reproducing and mitigating the CVE-2025-0108 issue path confusion / header smuggling between Nginx and Apache. The goal of the assignment is to demonstrate how double-encoded requests can bypass...

CVE-2026-88879

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. Due to a discrepancy in how Traefik and certain backend applications process HTTP header names, a remote attacker can smuggle specially crafted headers. This allows the attacker to bypass identity assertions made by Traefik,...

form-data: form-data: Form field override via CRLF injection

A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return CR, line feed LF, or double-quote " characters into the field argument of FormDataappend or the filename option. This allows th...

CVE-2026-88879

Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, XAuthUser and X.Auth.User are treated as three distinct headers by Traefik, while backends that derive variable...

EUVD-2026-75429

Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, XAuthUser and X.Auth.User are treated as three distinct headers by Traefik, while backends that derive variable...

PT-2026-89390

Summary There is a medium severity vulnerability in Traefik's handling of request headers whose name aliases another header name. Go canonicalizes header names on dashes only, so X-Auth-User, X Auth User and X.Auth.User are three distinct headers to Traefik, while backends that derive variable...

PT-2026-89699

Summary There is a medium severity vulnerability in Traefik's handling of request headers whose name aliases another header name. Go canonicalizes header names on dashes only, so X-Auth-User, X Auth User and X.Auth.User are three distinct headers to Traefik, while backends that derive variable...

CVE-2026-43971

A flaw was found in ninenines cowlib. This vulnerability, due to improper encoding or escaping of output, allows an attacker to perform Link header directive smuggling. By manipulating the target URI, 'rel' value, or attribute keys in applications that process Link headers through cowlib, a remot...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libevent (UTSA-2026-106160)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106160 advisory. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttpreadtrailer and merges...

Improper Handling of Case Sensitivity

Overview Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in the xDS RBAC HTTP filter, which unconditionally lowercases incoming metadata keys so a header matcher configured with uppercase letters, such as X-Role, never matches. An attacker can reach traff...

Improper Handling of Case Sensitivity

Overview Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in the xDS RBAC HTTP filter, which unconditionally lowercases incoming metadata keys so a header matcher configured with uppercase letters, such as X-Role, never matches. An attacker can reach traff...

libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning

A flaw was found in Libevent, an event notification library. An unauthenticated remote attacker can exploit a vulnerability where chunked HTTP Hypertext Transfer Protocol trailers are incorrectly merged into request headers. This allows the attacker to place security-sensitive fields in trailers,...

CVE-2026-63379

A flaw was found in Libevent, an event notification library. An unauthenticated remote attacker can exploit a vulnerability where chunked HTTP Hypertext Transfer Protocol trailers are incorrectly merged into request headers. This allows the attacker to place security-sensitive fields in trailers,...

Astra Linux – Vulnerability in Jetty9

Jetty is a Java-based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepted the + character that followed the content-length value in an HTTP/1 header field. This was more permissive than what is allowed by the RFC, and other servers routinely...

SUSE CVE-2026-63379

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttpreadtrailer and merges them into request headers. The fix introduces evhttpparseheadersimpl and a temporary trailer header list. An unauthenticated remote...

Linux Distros Unpatched Vulnerability : CVE-2026-43971

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in...

Linux Distros Unpatched Vulnerability : CVE-2026-63379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttpreadtrailer and...

CVE-2026-75484

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.readheaders/1 validates pseudo-header placement and...

EUVD-2026-63661

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.readheaders/1 validates pseudo-header placement and...

CVE-2026-75484

CVE-2026-75484 is a CRLF injection vulnerability in mtrudel bandit (Elixir HTTP server), versions 1.4.0 through before 1.12.5 . The root cause is in Bandit.HTTP2.Stream.read_headers/1, which validates header structure but never inspects field values . Because HPACK carries arbitrary octets, an un...