25305 matches found
The vulnerability of the axios library, related to insufficient validation of requests on the server side when processing NO_PROXY rules, allows attackers to execute SSRF attacks.
The vulnerability of the axios library is related to insufficient validation of requests on the server side when processing NOPROXY rules. Exploiting this vulnerability allows a remote attacker to perform an SSRF attack...
FreeBSD : Python -- HTTP proxy CONNECT tunnel does not sanitize CR/LF (30bda1c3-369b-11f1-b51c-6dd25bec137b)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 30bda1c3-369b-11f1-b51c-6dd25bec137b advisory. Seth Larson reports: HTTP proxy via CONNECT tunneling doesn't sanitize CR/LF CVE-2026-1502. Tenable has...
[SECURITY] Fedora 42 Update: trafficserver-10.1.2-1.fc42
Traffic Server is a high-performance building block for cloud services. It's more than just a caching proxy server; it also has support for plugins to build large scale web applications. Key features: Caching - Improve your response time, while reducing server load and bandwidth needs by caching...
SUSE-SU-2026:1281-1 Security update for the Linux Kernel (Live Patch 42 for SUSE Linux Enterprise 15 SP4)
This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.170 fixes various security issues The following security issues were fixed: - CVE-2025-39973: i40e: add validation for ringlen param bsc1252036. - CVE-2025-40018: ipvs: Defer ipvsftp unregister during netns cleanup bsc1252689. -...
SUSE CVE-2025-62718
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NOPROXY rules. Requests to loopback addresses like localhost. with a trailing dot or ::1 IPv6 literal skip NOPROXY matching and go...
CVE-2026-32281 vulnerabilities
Vulnerabilities for packages: direnv, x509-certificate-exporter, docker-credential-gcr, fscrypt, witness, spire-controller-manager, snyk-cli, ytt, kube-state-metrics, grafana-agent-operator, sftpgo-plugin-auth, hubble, stakater-reloader, kubeflow, vale, secrets-store-csi-driver-provider-aws,...
CVE-2026-32283 vulnerabilities
Vulnerabilities for packages: crossplane, crossplane-function-environment-configs-fips, memcached-exporter-fips, nerdctl, nri-haproxy-fips, cloud-provider-vsphere, apisix-ingress-controller, nrdot-collector-k8s-fips, cue-fips, kube-arangodb, esbuild-fips, nri-f5, spiffe-helper-fips, falco-exporte...
CVE-2025-62718
A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NOPROXY rules. An attacker can exploit this by crafting requests to loopback addresses e.g., localhost. or ::1 which bypass the NOPROXY...
EUVD-2026-21519
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...
AZL-82899 CVE-2026-1502 affecting package python3 for versions less than 3.12.9-11
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...
ALPINE-CVE-2026-1502
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...
DEBIAN-CVE-2026-1502
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...
CVE-2026-1502
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...
CVE-2026-1502
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...
UBUNTU-CVE-2026-1502
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...
CVE-2026-1502 HTTP client proxy tunnel headers not validated for CR/LF
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...
CVE-2026-1502
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...
CVE-2026-1502
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...
