CVE-2026-73812

A flaw was found in the inets httpd server, part of Erlang/OTP. The server incorrectly processes HTTP requests that contain both Transfer-Encoding: chunked and Content-Length headers, failing to reject them or close the connection as required by RFC 9112 §6.1. When inets is deployed behind a...

CVE-2021-40346

CVE-2021-40346 يسمح تجاوز السعة الصحيحة في التمثيل الداخلي لطلب الرأس بتهريب طلبات HTTP. يقدم هذا المستودع إثباتًا للمفهوم PoC مبنيًا باستخدام docker-compose مع صورتين من Docker: واحدة بإصدار ضعيف من HaProxy في هذه الحالة 2.2.16 وأخرى بخادم ويب Flask يستخدم Gunicorn كـ WSGI. من خلال استغلال الثغر...

Linux Distros Unpatched Vulnerability : CVE-2026-73812

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 6.3 identifies as a...

Linux Distros Unpatched Vulnerability : CVE-2026-73276

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before...

CVE-2026-33555

Contournement de la validation du corps FIN autonome via le trafic HTTP Request Smuggling HAProxy H3/QUIC Article complet ici : https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html Résumé Une vulnérabilité dans l'implémentation HTTP/3 de HAProxy permet à un attaquant...

CVE-2025-55315-Scanner-Monitor

Scanner de vulnérabilité CVE-2025-55315 et proxy TLS Ce dépôt contient des outils pour détecter et surveiller les applications ASP.NET Core vulnérables à la CVE-2025-55315, qui implique un trafic de requêtes HTTP HTTP request smuggling dû à des en-têtes HTTP conflictuels. Outils inclus 1. Scanner...

smugglex

ماسح ضوئي لتهريب طلبات HTTP مبني بلغة Rust. نظرة عامة Smugglex هي أداة اختبار أمان تكتشف ثغرات تهريب طلبات HTTP HTTP Request Smuggling في تطبيقات الويب. تختبر هجمات CL.TE وTE.CL وTE.TE وH2C وH2، وعلى الأهداف التي تعمل بنظام HTTPS — يتحدث بروتوكول HTTP/2 حقيقي ALPN h2 لاكتشاف تهريب الترقية من HTTP...

CVE-2024-40725

HTTP Request Smuggling Detection Tool This repository contains a Python-based tool to detect HTTP Request Smuggling vulnerabilities, specifically targeting CVE-2024-40725. The tool attempts to exploit this vulnerability in Apache HTTP Server by sending crafted HTTP requests and analyzing the...

CVE-2026-78605

Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' CWE-444 in Elasticsearch can lead to information disclosure via HTTP Request Smuggling CAPEC-33. Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other...

CVE-2021-31188

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:42+00:00| seen| https://t.me/hackingAttack/8312 2026-09-02 01:03:18+00:00| seen| https://t.me/hackingAttack/8312...

CVE-2025-55315

CVE-2025-55315 CVE-2025-55315 .NET HTTP Request Smuggling के लिए प्रूफ-ऑफ-कॉन्सेप्ट एक्सप्लॉइट। यह दर्शाता है कि किस प्रकार अनुचित तरीके से पार्स किया गया चंक्ड एन्कोडिंग हमलावरों को कमजोर ASP.NET Core/Kestrel सर्वरों में प्रॉक्सी और लोड बैलेंसर्स के पीछे अनुरोधों को तस्करी करने देता है। 📊...

EUVD-2026-69568

Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' CWE-444 in Elasticsearch can lead to information disclosure via HTTP Request Smuggling CAPEC-33. Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other...

CVE-2026-78605

Elasticsearch is affected by an HTTP Request Smuggling flaw (CWE-444) that can lead to information disclosure . Under specific proxy deployment configurations, a network attacker with no prior authentication could obtain confidential responses intended for other authenticated users. The CVSS 3.1 ...

CVE-2026-78605 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure

Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' CWE-444 in Elasticsearch can lead to information disclosure via HTTP Request Smuggling CAPEC-33. Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other...

CVE-2026-78605 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure

Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' CWE-444 in Elasticsearch can lead to information disclosure via HTTP Request Smuggling CAPEC-33. Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other...

CTF-Web-Exploitation

Nether Portal Desync HUUP "I travel not on established roads but leap freely across the void. Package me wrong, and I'll deliver a secret to the wrong doorstep." Description The challenge features an HTTP/3 QUIC application layered over UDP. Because UDP is stateless and the proxy doesn't enforce...

AZL-98487 CVE-2026-73276 affecting package erlang 26.2.5.21-4

Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7,...

CVE-2026-73276

Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7,...

CVE-2026-73812

httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...

CVE-2026-73812

Erlang/OTP inets (HTTP server module) is vulnerable to HTTP Request Smuggling (CL.TE desync) when deployed behind a Content-Length-preferring front-end proxy. The root cause is in httpd:check_header/3 , which rejects duplicate Content-Length headers but never validates the simultaneous presence o...