Lucene search
+L

37698 matches found

CVE
CVE
added 2026/07/28 12:18 p.m.11 views

CVE-2026-49332

The CVE-2026-49332 entry concerns openshift/oauth-proxy. Affected component: the proxy handling of authenticated identity headers. Root cause: the proxy uses dash-variant headers (e.g., X-Forwarded-User) but does not strip underscore-variant headers (X_Forwarded_User). Because WSGI and PHP framew...

8.5CVSS5.8AI score0.00194EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/07/28 12:18 p.m.5 views

EUVD-2026-49767

A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys X-Forwarded-User but does not strip underscore-variant keys XForwardedUser from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing a...

8.5CVSS5.8AI score0.00194EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/28 12:18 p.m.32 views

CVE-2026-49332 Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams

A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys X-Forwarded-User but does not strip underscore-variant keys XForwardedUser from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing a...

8.5CVSS0.00194EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/07/28 12:13 p.m.10 views

CVE-2026-49332

A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys X-Forwarded-User but does not strip underscore-variant keys XForwardedUser from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing a...

8.5CVSS5.8AI score0.00194EPSS
SaveExploits0References3
NVD
NVD
added 2026/07/28 11:17 a.m.8 views

CVE-2026-17072

A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being...

3.3CVSS0.00116EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/07/28 10:25 a.m.6 views

EUVD-2026-49750

A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being...

3.3CVSS5.8AI score0.00116EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/28 10:16 a.m.4 views

DEBIAN-CVE-2026-65624

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. The HTTP/1.1 handler in cowboyhttp enforces the maxheaders limit by counting the number of distinct header names in ...

6.9CVSS6AI score0.00383EPSS
SaveExploits0References1
SUSE Linux
SUSE Linux
added 2026/07/28 10:4 a.m.6 views

Security update for nmap

This update for nmap fixes the following issue: CVE-2026-58058: crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash bsc1269570. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

6.9CVSS6.6AI score0.00278EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/07/28 10:1 a.m.33 views

CVE-2026-65624 Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. The HTTP/1.1 handler in cowboyhttp enforces the maxheaders limit by counting the number of distinct header names in ...

6.9CVSS0.00383EPSS
SaveExploits0References3
Debian CVE
Debian CVE
added 2026/07/28 10:1 a.m.6 views

CVE-2026-65624

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. The HTTP/1.1 handler in cowboyhttp enforces the maxheaders limit by counting the number of distinct header names in ...

6.9CVSS6AI score0.00383EPSS
SaveExploits0
ATTACKERKB
ATTACKERKB
added 2026/07/28 10:1 a.m.8 views

CVE-2026-65624

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. The HTTP/1.1 handler in cowboyhttp enforces the maxheaders limit by counting the number of distinct header names in ...

6.9CVSS6AI score0.00383EPSS
SaveExploits0References4
CVE
CVE
added 2026/07/28 10:1 a.m.14 views

CVE-2026-65624

The CVE affects the Cowboy HTTP/1.1 handler. The root cause is a per-request header handling flaw: when a request uses repeated header names, values are concatenated into a single binary under one map key, so the max_headers limit never increases and the total header block can grow without bound....

6.9CVSS6AI score0.00383EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/28 10:1 a.m.4 views

EEF-CVE-2026-65624 Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion

Summary Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. The HTTP/1.1 handler in cowboy\http enforces the max\headers limit by counting the number of distinct header...

6.9CVSS6AI score0.00383EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2026/07/28 10:1 a.m.8 views

CVE-2026-65624 Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. The HTTP/1.1 handler in cowboyhttp enforces the maxheaders limit by counting the number of distinct header names in ...

6.9CVSS6AI score0.00383EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/07/28 9:54 a.m.8 views

CVE-2026-59248

Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server or client and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cowhpackcommon:decbigint/3 in...

8.7CVSS5.9AI score0.00291EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/07/28 9:54 a.m.7 views

EUVD-2026-49739

Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server or client and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cowhpackcommon:decbigint/3 in...

8.7CVSS5.9AI score0.00291EPSS
SaveExploits0References3
SUSE Linux
SUSE Linux
added 2026/07/28 9:40 a.m.6 views

Security update for nmap

This update for nmap fixes the following issue CVE-2026-58058: crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash bsc1269570. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

6.9CVSS6.6AI score0.00278EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/07/28 9:13 a.m.5 views

CVE-2026-59897

A flaw was found in Hono, a web application framework. The AWS API Gateway v1 adapter incorrectly de-duplicates repeated request header values using a substring comparison, rather than an exact match. This can lead to incomplete data being received by middleware or application logic that relies o...

5.3CVSS5.8AI score0.00126EPSS
SaveExploits0References6
OSV
OSV
added 2026/07/28 9:8 a.m.3 views

BIT-THRIFT-2026-55971 Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()

Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

9.8CVSS5.8AI score0.01042EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
added 2026/07/28 9:7 a.m.7 views

httpd: incomplete fix for CVE-2023-38709

A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers. These issues lead to HTTP response splitting. This CVE provides a "complete" fix for CVE-2023-38709...

7.5CVSS6.7AI score0.03914EPSS
SaveExploits0References5
Rows per page
Query Builder