CVE-2019-20372

REFER https://bertjwregeer.keybase.pub/2019-12-10%20-%20errorpage%20request%20smuggling.pdf Chạy Server docker run -it --rm -p 80:80 -v pwd/default.conf:/etc/nginx/conf.d/default.conf nginx:1.17.6 Khai thác printf "GET /a HTTP/1.1\r\nHost: localhost\r\nContent-Length: 56\r\n\r\nGET...

node-poc-http-smuggling

This repository does not have a README...

SUSE SLES12: libsoup-2_4-1 / libsoup-2_4-1-32bit / libsoup-devel / libsoup-lang / etc (SUSE-SU-2026:4690-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4690-1 advisory. - CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame bsc1271401. - CVE-2026-12547: Header...

Linux Distros Unpatched Vulnerability : CVE-2026-57488

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, rawtoint in upnp/src/genlib/net/http/httpparser.c parses...

F5-BIG-IP-SmuggleShell-CVE-2023-46747-Exploit

F5 BIG-IP CVE-2023-46747 – Unauthenticated RCE + Reverse Shell Python3 & Nuclei versions – by raguraman Critical unauth RCE CVSS 9.8 via AJP + HTTP request smuggling Works on all unpatched BIG-IP 13.x → 17.x including latest 17.1.0.3 Patch: https://my.f5.com/manage/s/article/K000137353 Nov 2023...

CVE-2026-57488

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, rawtoint in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values...

CVE-2026-57488 pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, rawtoint in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values...

CVE-2026-57488 pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, rawtoint in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values...

EUVD-2026-102930

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, rawtoint in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values...

CVE-2026-57488

The pupnp SDK (versions prior to 2.0.2 ) contains an integer truncation vulnerability in the raw_to_int function located at upnp/src/genlib/net/http/httpparser.c. The root cause is that Content-Length is parsed using strtol and then cast to a 32-bit int before being stored as an unsigned int. On ...

CVE-2026-70188

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Produ...

CVE-2026-88092

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

Security update for libsoup2

This update for libsoup2 fixes the following issues: CVE-2026-12547: Header "Proxy-Authorization" leads to credentials being send to different proxy after proxy switch bsc1272195. CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol...

SUSE-SU-2026:4703-1 Security update for libsoup2

This update for libsoup2 fixes the following issues: - CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch bsc1272195. - CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol...

SmuggleMyPayload

SmuggleMyPayload SmuggleMyPayload is an HTML Smuggling toolkit for generating HTML pages that embed and reconstruct files using JavaScript. It provides multiple HTML Smuggling methods, payload encoding options, JavaScript variations, and several built-in HTML templates. Features Multiple HTML...

poc-h2-CVE-2026-71554

CVE-2026-71554 - h2 Duplicate Host Header Request Smuggling Primitive This is my first CVE, and I have released this PoC to document the finding and help others understand and reproduce it. CVE: CVE-2026-71554 GHSA: GHSA-6hr6-w5qg-qmwg Affected: h2 = 4.4.0 Fixed: h2 4.4.1 Severity: Medium CWE-444...

Security update for libsoup

This update for libsoup fixes the following issues: CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame bsc1271401. CVE-2026-12547: Header "Proxy-Authorization" leads to credentials being send to different proxy after proxy switch bsc1272195. CVE-2026-15711:...

SUSE-SU-2026:4690-1 Security update for libsoup

This update for libsoup fixes the following issues: - CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame bsc1271401. - CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch bsc1272195. - CVE-2026-15711:...

BIT-GOLANG-2026-94439 HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

BIT-GOLANG-2026-78660 HTTP/2 transport accepts malformed framing-related headers in net/http

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...