CVE-2026-96748 Connection redirection via percent-encoded delimiter injection in connection string hosts

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

CVE-2026-96748 Connection redirection via percent-encoded delimiter injection in connection string hosts

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

CVE-2026-96748

The PyMongo database driver is vulnerable to connection redirection due to percent-encoded delimiter injection in connection string hosts. The root cause is that PyMongo decodes percent-encoded characters in the host portion before separating the host list by delimiters. If an application include...

CVE-2026-96748 Connection redirection via percent-encoded delimiter injection in connection string hosts

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

Connection redirection via percent-encoded delimiter injection in connection string hosts

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects

A flaw was found in fast-uri, a software component used for parsing Uniform Resource Identifiers URIs in Node.js applications. This vulnerability arises from an issue in how fast-uri processes the scheme part of a URI, specifically when it contains special characters that are percent-encoded. An...

CVE-2026-96748

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

CVE-2026-86253

A flaw was found in h3, an npm package. An unauthenticated remote attacker can exploit this vulnerability by sending crafted requests to endpoints served by the serveStatic function. On Node.js deployments, the event.url.pathname is not properly normalized, allowing percent-encoded dot segments t...

keycloak-services: keycloak-services: Incomplete fix for CVE-2026-15573 allows policy enforcer bypass via percent-encoded URI segments

Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directo...

CVE-2026-74909 Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments

Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directo...

CVE-2026-74909

CVE-2026-74909 is an incomplete fix for CVE-2026-15573 in Keycloak's policy enforcer (component: keycloak-services). The enforcer fails to correctly normalize URLs containing percent-encoded characters such as semicolons or directory-traversal segments, allowing an authenticated user to trick the...

CVE-2026-74909 Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments

Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directo...

Directory Traversal

Overview org.http4s:http4s-server2.12 is a base library for building http4s servers. Affected versions of this package are vulnerable to Directory Traversal via the ResourceService and WebjarService when percent-encoded slash or backslash separators in URL path segments are decoded. An attacker c...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the ResourceService and WebjarService when percent-encoded slash or backslash separators in URL path segments are decoded. An attacker can access resources outside the configured base directory by crafting reques...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the ResourceService and WebjarService when percent-encoded slash or backslash separators in URL path segments are decoded. An attacker can access resources outside the configured base directory by crafting reques...

Http4s: ResourceService and Webjar Service path escape via percent-encoded separators

The static content handlers ResourceService and WebjarService URL decode each path segment and then reject only segments that are exactly "", ".", or "..". A percent-encoded separator %2F lets an attacker smuggle a ../ segment past that filter and escape the configured base, reading resources tha...

GHSA-CRQ5-92J2-J7WV Http4s: ResourceService and Webjar Service path escape via percent-encoded separators

The static content handlers ResourceService and WebjarService URL decode each path segment and then reject only segments that are exactly "", ".", or "..". A percent-encoded separator %2F lets an attacker smuggle a ../ segment past that filter and escape the configured base, reading resources tha...

CVE-2026-69201 Http4s: ResourceService and Webjar Service path escape via percent-encoded separators

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResourceService and WebjarService decode each URL path segment but reject only segments exactly equal to an empty string, a dot, or two dots. A request containing percent-encoded slash or backslash separators can turn ...

EUVD-2026-79177

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResourceService and WebjarService decode each URL path segment but reject only segments exactly equal to an empty string, a dot, or two dots. A request containing percent-encoded slash or backslash separators can turn ...

CVE-2026-69201

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResourceService and WebjarService decode each URL path segment but reject only segments exactly equal to an empty string, a dot, or two dots. A request containing percent-encoded slash or backslash separators can turn ...