tomcat-line-check

tomcat-line-check CVE-2026-24880 · GHSA-563x-q5rq-57qp —— Does Apache's upgrade to version 11.0.20, 10.1.52 or 9.0.116 actually apply to you? For most people it doesn't, and there are four different ways it doesn't apply. This tool scans your artifacts and tells you which one it is. java -jar...

CVE-2026-66731-Negative-Chunk-Size-Parsing-Causes-Memory-Corruption-leading-to-Server-Crash

Security Advisory: Negative Chunk-Size Parsing Causes Memory Corruption in facil.io Assigned CVE ID : CVE-2026-66731 Product: facil.io Affected versions: facil.io = 0.7.5 0.7.5, 0.7.6, master; introduced when the 0.8.x HTTP/1.1 parser was backported in 0.7.5 - not present in 0.6.x or 0.7.0–0.7.3...

CVE-2026-116130

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

CVE-2026-116130

A flaw was found in HTTP::Parser::XS. When processing HTTP request paths, the parser URL-decodes the path and terminates the string at decoded null bytes rather than using the full path length. A remote attacker can exploit this flaw by sending a crafted path containing an encoded null byte %00 t...

CVE-2026-116130

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

EUVD-2026-113904

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

CVE-2026-116130 HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

CVE-2026-116130

The HTTP::Parser::XS module for Perl, in versions before 0.18 , is vulnerable to a Null Byte Interaction Error (CWE-626) . The XS parser URL-decodes the request path and uses strlen() to measure the result, causing PATH_INFO to be truncated at the first byte decoded from %00 . This issue specific...

CVE-2026-116130 HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

PT-2026-133523

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH INFO at an encoded NUL byte in parse http request. The XS parser URL-decodes the request path and measures the result with strlen, so PATH INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote...

CVE-2026-116130: Null Byte Interaction Error (Poison Null Byte)

HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...

Node.js 26.5.0 HTTP Parser Header Truncation Request Smuggling

Node.js versions before 22.23.2, 24.18.1, and 26.5.1 contain an HTTP parser header-truncation flaw that can enable request smuggling in affected forwarding-proxy configurations. This offline checker evaluates operator-supplied version evidence without probing targets...

Node.js HTTP Parser Header Truncation Request Smuggling

Node.js versions 22.x, 24.x, and 26.x contain an HTTP parser header truncation issue that can enable request smuggling in specific forwarding-proxy configurations. Reported fixed versions are 22.23.2, 24.18.1, and 26.5.1...

SUSE CVE-2026-57487

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser-contentlength at zero while parserparsechunkyentity and parserparsechunkybody accumulate decode...

CVE-2026-86146 Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing

Inconsistent interpretation of HTTP requests HTTP request/response smuggling in the bundled HTTP/1.1 parser of Apache bRPC version 1.18.0 on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same byte...

CVE-2026-86146

Apache bRPC (versions

CVE-2026-57487

A flaw was found in libupnp. The HTTP parser fails to enforce configured message size limits when processing chunked transfer-encoded HTTP requests. A remote attacker can exploit this vulnerability by sending an excessively large chunked payload, forcing the application to buffer data beyond...

CLEANSTART-2026-QX63869 HTTP parser in all current versions of Node

Security vulnerability affects the nodejs-24 package. The HTTP parser in all current versions of Node...

EUVD-2026-104486

AIOHTTP: Pure-Python parser request smuggling...

DEBIAN-CVE-2026-111750

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTPNOEXTENSIONS or otherwise runs without a...