48979 matches found
CVE-2026-66746
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...
CVE-2026-67181
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to...
UBUNTU-CVE-2026-66753
tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return 0x0D and line feed 0x0A bytes into HTTP header values on both request and response sides due to insufficient validation in header parsing and serialization. Attackers can explo...
CVE-2026-66746
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...
CVE-2026-66753
tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return 0x0D and line feed 0x0A bytes into HTTP header values on both request and response sides due to insufficient validation in header parsing and serialization. Attackers can explo...
CVE-2026-51266
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-51271
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-67182 Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Header Injection
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters 0x0A into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers...
CVE-2026-67182 Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Header Injection
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters 0x0A into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers...
CVE-2026-67182 Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Header Injection
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters 0x0A into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers...
EUVD-2026-49895
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters 0x0A into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers...
CVE-2026-67182
Rouille 0.3.3 through 3.6.2 is affected by an HTTP request smuggling vulnerability. An attacker can inject bare line feed characters (0x0A) into client-supplied header values, which are copied verbatim to upstream connections without validation. A crafted header value can contain a complete addit...
GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)
Summary The Diameter AVP decoder in github.com/gopacket/gopacket computes dataLength := avp.Length - uint32headerSize without first ensuring avp.Length = headerSize. When the Vendor flag is set, headerSize is 12, but the only length guard upstream rejects avp.Length CWE-770 unbounded allocation...
CVE-2026-54345 GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)
gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a vendor-flagged AVP whose Length is smaller than the 12-byte header...
CVE-2026-67181 Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding Header
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to...
CVE-2026-67181
Rouille versions 0.3.3 through 3.6.2 are affected by an HTTP request smuggling vulnerability via the proxy Transfer-Encoding header. The issue arises because the proxy in src/proxy.rs forwards the client’s Transfer-Encoding header to upstream backends unchanged while transmitting a body that has ...
EUVD-2026-49890
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to...
CVE-2026-66746 Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...
CVE-2026-66746
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...
EUVD-2026-49889
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...