CVE-2026-86350

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-86350 CVE-2026-86350 Apache Tomcat 9.0.121 - Apache Software Foundation I am @abraxasnull. Loopback lab. The client is CVE-2026-86350-Abraxas-Labs.py. HTTP/2 header mix-up. A regression in the CVE-2026-41293...

CVE-2026-70188

A flaw was found in the Kestrel web server in ASP.NET Core. The server incorrectly accepts newline characters in HTTP/2 request trailers and dynamic header compression values instead of rejecting them as malformed. A remote, unauthenticated attacker can exploit this vulnerability by sending...

CVE-2026-88092

A flaw was found in ASP.NET Core Kestrel. When an HTTP Hypertext Transfer Protocol connection is aborted, unread bytes from the request body can be reparsed as a new incoming request. A remote attacker can exploit this desynchronization issue to perform HTTP request smuggling, potentially leading...

PT-2026-115878

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

Security Update for Microsoft ASP.NET Core (October 2026)

The Microsoft ASP.NET installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory. - Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorize...

Security Update for Microsoft .NET Core SDK (October 2026)

The Microsoft .NET Core SDK installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory. - Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an...

Security Updates for Microsoft Visual Studio Products 17.14.42 and 18.10.4 (October 2026)

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network. CVE-2026-105016 - Inconsistent interpretation of http requests...

USN-8931-1: Apache HTTP Server vulnerabilities

이지웅 discovered that Apache HTTP Server exposed WebDAV property information. A remote attacker could possibly use this issue to obtain sensitive information. CVE-2026-58415 Zhen Kong and Charles Vosburgh discovered that Apache HTTP Server did not properly validate FTP server responses. A remote...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130139)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130139 advisory. Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat via invalid chunk extension. This issue affects Apache...

CVE-2026-88092

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

CVE-2026-70188

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network...

EUVD-2026-100147

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

CVE-2026-88092

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

CVE-2026-88092

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

CVE-2026-70188

A vulnerability in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network due to the inconsistent interpretation of HTTP requests (HTTP request/response smuggling). The vulnerability is listed with a CVSS score of 9.10 and results in the exploitation of security ...

EUVD-2026-99700

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-70188

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-70188

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network...

ASP.NET Core Tampering Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

ASP.NET Core Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network...