CVE-2026-59298 Potential for improper filtering of HTTP headers in Spring Cloud Function

Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier...

CVE-2026-59298 Potential for improper filtering of HTTP headers in Spring Cloud Function

Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier...

CVE-2026-59298

Spring Cloud Function is affected by improper filtering of HTTP headers , allowing potential header manipulation. The vulnerability spans multiple release lines: 5.0.0–5.0.3 , 4.3.0–4.3.4 , 4.2.0–4.2.7 , and 3.2.16 and earlier . The CVSS 3.1 score is 3.1 (LOW) , reflecting a network-based attack ...

PT-2026-82706

Name of the Vulnerable Software and Affected Versions Spring Cloud Function versions 5.0.0 through 5.0.3 Spring Cloud Function versions 4.3.0 through 4.3.4 Spring Cloud Function versions 4.2.0 through 4.2.7 Spring Cloud Function versions 3.2.16 and earlier Description There is a potential for...

CVE-2026-59298: Improper Input Validation

Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier...

JetBrains TeamCity < 2019.1 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2019.1. It is, therefore, affected by multiple vulnerabilities: - An issue was discovered in JetBrains TeamCity 2018.2.4. A TeamCity Project administrator could get access to potentially confidential server-level data. The...

GHSA-92HV-J533-69WC Wagtail: Identification of documents by SHA1 hash

Impact By passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to...

Wagtail: Identification of documents by SHA1 hash

Impact By passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to...

CVE-2026-50576: Improper Neutralization of CRLF Sequences in HTTP Headers

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The...

JLSEC-2026-1342 When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed...

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of header...

BIT-RCLONE-2026-71310 rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to unfiltered operationName and operationNamespace headers from inbound HTTP requests, which allows an attacker to control the SOAP operation invoked by the CXF producer and potentially trigger unintended or...

Authorization Bypass

Apache Camel Lucene Component is vulnerable to Authorization Bypass. The vulnerability is due to the camel-lucene producer accepting the QUERY and RETURNLUCENEDOCS headers from inbound HTTP requests because HttpHeaderFilterStrategy only blocks the Camel-prefixed header namespace, where an attacke...

Improper Input Validation

Apache Camel JIRA component is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of JIRA control headers, where attacker-controlled HTTP headers can override configured issue keys, project keys, transitions, and other operation parameters, allowing...

CVE-2026-66778: Improper Neutralization of HTTP Headers for Scripting Syntax

SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a specially crafted request to obtain limited unauthorized access to information. This results in a low impact on confidentiality. There is...

PT-2026-76028

Traefik's errors middleware by default forwards all original request headers to the error page service. If the error page service is in a separate trust domain, this can lead to the disclosure of sensitive information such as Authorization or Cookie headers. The fix adds an errorRequestHeaders...

Improper Input Validation

Apache Camel IRC component is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of IRC control headers, where attacker-controlled irc. headers from untrusted HTTP requests can override the intended message destination, allowing unauthorized message...

CVE-2026-54465

A flaw was found in websocket-driver, a WebSocket protocol handler. A remote attacker can exploit this vulnerability by sending an HTTP request or response with a never-ending list of headers to a server or client using websocket-driver. This can cause the receiving process to consume an unbounde...

CVE-2026-0516

A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host header and redirect firewall management users to arbitrary web domains...

SonicOS Improper Neutralization of HTTP Headers Vulnerability

A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host header and redirect firewall management users to arbitrary web domains. CVE: CVE-2026-0516 Last updated: Aug. 11, 2026, 1:23 p.m...