3979 matches found
io.netty/netty-codec-http: Netty: HTTP response desynchronization via HttpServerCodec
A flaw was found in Netty's HttpServerCodec. A remote attacker can exploit this vulnerability to cause HTTP response desynchronization, leading to response splitting and potential information disclosure. By sending pipelined requests with informational headers followed by another request, the...
CVE-2026-21850
HCL AION is affected by a vulnerability where user-controlled input could be included in HTTP response headers without proper neutralization of CR/LF characters. This may allow an attacker to inject headers or split responses, potentially resulting in unintended behavior or security impact under...
CVE-2026-21850
HCL AION is affected by a vulnerability involving the improper neutralization of CR/LF characters in HTTP response headers. An attacker could provide user-controlled input that is included in these headers without proper sanitization, potentially enabling header injection or response splitting . ...
EUVD-2026-118263
HCL AION is affected by a vulnerability where user-controlled input could be included in HTTP response headers without proper neutralization of CR/LF characters. This may allow an attacker to inject headers or split responses, potentially resulting in unintended behavior or security impact under...
CVE-2026-21850 HCL AION is affected by multiple security vulnerabilities.
HCL AION is affected by a vulnerability where user-controlled input could be included in HTTP response headers without proper neutralization of CR/LF characters. This may allow an attacker to inject headers or split responses, potentially resulting in unintended behavior or security impact under...
io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough)
A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...
io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough)
A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...
CVE-2023-0214
SWG Exploit Generator ██████╗ ██████╗ ████████╗███████╗ ██╔═████╗██╔══██╗╚══██╔══╝██╔════╝ ██║██╔██║██████╔╝ ██║ ███████╗ ████╔╝██║██╔═══╝ ██║ ╚════██║ ╚██████╔╝██║ ██║ ███████║ ╚═════╝ ╚═╝ ╚═╝ ╚══════╝ by 0PTS Proof of Concept for the HTTP Response Splitting vulnerability in Skyhigh Secure Web...
CVE-2026-21850: HCL Software HCL AION: HCL AION is affected by a vulnerability where user-controlled input could be included in HTTP response headers without…
HCL AION is affected by a vulnerability where user-controlled input could be included in HTTP response headers without proper neutralization of CR/LF characters. This may allow an attacker to inject headers or split responses, potentially resulting in unintended behavior or security impact under...
CVE-2026-73117
Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' vulnerability in Apache Juneau. The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets a response header or redirect target fr...
CVE-2026-73117
The Apache Juneau REST server (through version 9.2.0 ) is vulnerable to HTTP Response Splitting due to the improper neutralization of CRLF sequences in HTTP headers. The framework fails to check response header values and redirect targets before passing them to the servlet container. If an applic...
EUVD-2026-117412
Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' vulnerability in Apache Juneau. The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets a response header or redirect target fr...
CVE-2026-108767
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct HTTP response splitting due to improper neutralization of HTTP headers...
CVE-2026-108767
IBM Db2 Genius Hub versions 1.1.2, 1.1.3, 1.1.4, and 1.1.5 are vulnerable to HTTP response splitting . This flaw is caused by the improper neutralization of HTTP headers , which could allow a remote authenticated attacker to exploit the system. The vulnerability is associated with CWE-113 . No sp...
EUVD-2026-117109
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct HTTP response splitting due to improper neutralization of HTTP headers...
io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough)
A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...
CVE-2026-85254
A flaw was found in Apache Camel's Platform HTTP component. The mechanism designed to prevent request headers from being reflected into HTTP responses improperly compares header names using case-sensitive checks. A remote attacker can exploit this behavior by varying header name casing or sending...
CVE-2026-120639
A flaw was found in perl-cgi, where it fails to properly validate newline characters when generating HTTP headers. When an application passes untrusted input into header fields, entity-encoded newlines or unvalidated parameters can bypass sanitization checks. A remote attacker could exploit this...
Ubuntu 16.04 LTS : Apt-Cacher vulnerability (USN-8976-1)
The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8976-1 advisory. It was discovered that Apt-Cacher did not properly handle encoded newline characters in requests. A remote attacker could possibly use this issue to perform HTTP...
