CVE-2026-118372

LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host copies the path without rejecting control characters and httpopen places it in the POST request...

CVE-2026-118371

LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSPsendreqnew and OCSPparseurl functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information...

CVE-2026-118371 LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line

LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSPsendreqnew and OCSPparseurl functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information...

PT-2026-127737

LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP sendreq new and OCSP parse url functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Informati...

SUSE CVE-2026-112880

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in hackneyhttpconnect in benoitc hackney allows HTTP Request Splitting via the value a proxyauthfun callback returns. After a 407 response from an HTTP CONNECT proxy,...

CVE-2026-112880

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in hackneyhttpconnect in benoitc hackney allows HTTP Request Splitting via the value a proxyauthfun callback returns. After a 407 response from an HTTP CONNECT proxy,...

CVE-2026-112880 CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in hackneyhttpconnect in benoitc hackney allows HTTP Request Splitting via the value a proxyauthfun callback returns. After a 407 response from an HTTP CONNECT proxy,...

EEF-CVE-2026-112880 CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney

Summary Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in hackneyhttpconnect in benoitc hackney allows HTTP Request Splitting via the value a proxyauthfun callback returns. After a 407 response from an HTTP CONNECT proxy,...

EUVD-2026-109833

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in hackneyhttpconnect in benoitc hackney allows HTTP Request Splitting via the value a proxyauthfun callback returns. After a 407 response from an HTTP CONNECT proxy,...

CVE-2026-112880 CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in hackneyhttpconnect in benoitc hackney allows HTTP Request Splitting via the value a proxyauthfun callback returns. After a 407 response from an HTTP CONNECT proxy,...

CVE-2026-112880

The benoitc hackney library (versions 2.0.0 before 4.9.0) is vulnerable to an HTTP Request Splitting vulnerability (CWE-113) in the hackney_http_connect module. The root cause is the lack of control-byte validation on the binary returned by the proxy_auth_fun callback. When a proxy returns a 407 ...

CVE-2026-112880 CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in hackneyhttpconnect in benoitc hackney allows HTTP Request Splitting via the value a proxyauthfun callback returns. After a 407 response from an HTTP CONNECT proxy,...

CVE-2026-112880

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in hackneyhttpconnect in benoitc hackney allows HTTP Request Splitting via the value a proxyauthfun callback returns. After a 407 response from an HTTP CONNECT proxy,...

PT-2026-123303

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in hackney http connect in benoitc hackney allows HTTP Request Splitting via the value a proxy auth fun callback returns. After a 407 response from an HTTP CONNECT proxy, hackney http...

Security Bulletin: Worksoft Connective Automation Platform for IBM is affected by a vulnerability in NuGet RestSharp

Summary NuGet RestSharp is used by Worksoft Connective Automation Platform for IBM as part of .Net6 CVE-2024-45302 Vulnerability Details CVEID:CVE-2024-45302 DESCRIPTION: RestSharp is a Simple REST and HTTP API Client for .NET. The second argument to RestRequest.AddHeader the header value is...

Astra Linux – Vulnerability in Apache2

A properly crafted method sent via HTTP/2 will bypass validation and be forwarded by modproxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server versions 2.4.17 to 2.4.48...

CVE-2026-103930

A flaw was found in cpp-httplib. The library is vulnerable to HTTP request splitting due to improper encoding of carriage-return and line-feed characters within streaming request paths. If an application forwards untrusted user input to the streaming client interface, a remote attacker can supply...

CLEANSTART-2026-XX88354 crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning

Security vulnerability affects the apache2 package. A crafted method sent through HTTP/2 will bypass validation and be forwarded by modproxy, which can lead to request splitting or cache poisoning...

Rocky Linux 9 [CIQ] Security Update: httpd / httpd-core / httpd-core-debuginfo / httpd-debuginfo / etc (crlsa-2023_1670)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20231670 advisory. httpd: HTTP request splitting with modrewrite and modproxy CVE-2023-25690 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 8 [CIQ] Security Update: httpd / httpd-debuginfo / httpd-debugsource / httpd-devel / etc (crlsa-2023_1673)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20231673 advisory. httpd: HTTP request splitting with modrewrite and modproxy CVE-2023-25690 Tenable has extracted the preceding description block directly from the CIQ security...