org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers

A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or...

CVE-2026-11870: Authentication Bypass by Spoofing

The WP Ghost Hide My WP Ghost WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headers, allowing unauthenticated attackers to spoof their IP address to bypass the WP Ghost Hide My WP Ghost WordPress...

CVE-2026-58155

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or...

CVE-2026-58154

Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which f...

CVE-2026-58154: Out-of-bounds Write

Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which f...

📄 rouille 3.6.2 HTTP Request Smuggling

rouille versions 3.6.2 and earlier contain an HTTP request smuggling vulnerability in the proxy::proxy and proxy::fullproxy functions. Client-supplied HTTP header values are forwarded to backend servers without validation for control characters, allowing attackers to inject additional HTTP reques...

PT-2026-65731

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 Description Apache Traffic Server contains memory-safety errors that allow the system t...

CVE-2026-67183 TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

Pypiserver <1.2.5 - Carriage Return Line Feed Injection Detection

Pypiserver through 1.2.5 and below is susceptible to carriage return line feed injection. An attacker can set arbitrary HTTP headers and possibly conduct cross-site scripting attacks via a %0d%0a in a URI. !/usr/bin/env python3 -- coding: utf-8 -- """Pypiserver through 1.""" import re from...

viewLinc 5.1.2.367 - Carriage Return Line Feed Attack Detection

viewLinc 5.1.2.367 and sometimes 5.1.1.50 allows remote attackers to inject a carriage return line feed CRLF character into the responses returned by the product, which allows attackers to inject arbitrary HTTP headers into the response returned. !/usr/bin/env python3 -- coding: utf-8 --...

Host Header Injection Detection

HTTP header injection is a general class of web application security vulnerability which occurs when Hypertext Transfer Protocol headers are dynamically generated based on user input. !/usr/bin/env python3 -- coding: utf-8 -- """HTTP header injection is a general class of web application security...

Django Detection

An instance running Django is detected by looking for specific HTTP headers, HTML tags, and known endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """An instance running Django is detected by looking for specific HTTP headers, HTML tags, and known endpoints.""" from kittysploit import from...

NiceGUI Detection

An instance running NiceGUI is detected by looking for specific HTTP headers. !/usr/bin/env python3 -- coding: utf-8 -- """An instance running NiceGUI is detected by looking for specific HTTP headers.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

AZL-94308 CVE-2026-65624 affecting package rabbitmq-server for versions less than 3.13.7-9

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. The HTTP/1.1 handler in cowboyhttp enforces the maxheaders limit by counting the number of distinct header names in ...

CVE-2026-65624

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. The HTTP/1.1 handler in cowboyhttp enforces the maxheaders limit by counting the number of distinct header names in ...

EUVD-2026-49740

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. The HTTP/1.1 handler in cowboyhttp enforces the maxheaders limit by counting the number of distinct header names in ...

CVE-2026-55403: Exposure of Sensitive Information to an Unauthorized Actor

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodelcodegenerator/http.py getbody reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped...

CVE-2026-51269

...

Security Bulletin: Security Vulnerability in Spring-Security affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-22732)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Spring-Security Vulnerability Details CVEID:CVE-2026-22732 DESCRIPTION: When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility th...

Vulnerabilities found in Oracle Financial Services

Oracle has identified vulnerabilities in various Financial Services modules. Oracle has also processed updates for various third-party products. The vulnerabilities include code injection through malicious schemes in Apache Avro, unauthorized access to sensitive data in various Oracle products, a...