Apache2 - Transfer-Encoding Chunked XSS

Apache2 PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 contain a reflected cross-site scripting vulnerability caused by mishandling of chunked transfer-encoding requests in sapi/apache2handler/sapiapache2.c. Attackers can execute malicious scripts via crafted...

CVE-2026-128127

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, BodyPartReader.readchunk processing a multipart part with Content-Transfer-Encoding set to base64 keeps reading until the chunk length is a multiple of four without enforcing a byte limit. A short...

CVE-2020-25613

POC POST / HTTP/1.1 Host: 127.0.0.1:1080 Content-Type: text/html Content-Length: 129 Connection: keep-alive Transfer-Encoding: 0xb chunked 1 A 0 POST /flag HTTP/1.1 Host: 127.0.0.1:1080 Content-Length: 180 Connection: keep-alive Content-Type: text/html URI:...

CVE-2026-128127

The AIOHTTP asynchronous HTTP framework for Python and asyncio is vulnerable to a memory exhaustion or event loop spinning issue in versions prior to 3.14.4 . The root cause lies in the BodyPartReader.read_chunk() function, which fails to enforce a byte limit when processing multipart parts with ...

CVE-2025-55315-detection-playground

Here are some tests that can be performed against these services to observe different behavior on GET/POST routes between the patched and unpatched versions of Kestrel. GET against unpatched sends 200 and socket remains open printf 'GET / HTTP/1.1\r\nHost: localhost\r\nTransfer-Encoding:...

CVE-2026-67181-HTTP-Request-Smuggling-via-Transfer-Encoding-Desynchronization-rouille-

Security Advisory: HTTP Request Smuggling via Transfer-Encoding Desynchronization rouille Assigned CVE ID: CVE-2026-67181 Summary rouille::proxy::proxy forwards the client's Transfer-Encoding header to the backend unchanged, but writes the request body that tinyhttp has already de-chunked. It nev...

RLSA-2026:98643 Important: squid security update

Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects. Security Fixes: squid: squid: Request Smuggling in HTTP Transfer-Encoding CVE-2026-61642 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

squid security update

An update is available for squid. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Squid is a high-performance proxy caching server for web clients, supporting...

squid security update

An update is available for squid. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Squid is a high-performance proxy caching server for web clients, supporting FT...

RLSA-2026:98537 Important: squid security update

Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects. Security Fixes: squid: squid: Request Smuggling in HTTP Transfer-Encoding CVE-2026-61642 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

CVE-2026-66752-HTTP-Request-Smuggling-via-Unparsed-Transfer-Encoding-Values-tiny_http-

Security Advisory: HTTP Request Smuggling via Unparsed Transfer-Encoding Values tinyhttp Assigned CVE ID: CVE-2026-66752 Summary tinyhttp checks only whether a Transfer-Encoding header is present. It never looks at the value. Any value, including codings that are not chunked and coding lists whos...

CVE-2013-2028-Exploit

CVE-2013-2028 Exploit Vulnerability Details Vulnerable software: Nginx 1.3.9 Vulnerable function: ngxhttpparsechunked CVE-2013-2028 is an integer overflow vulnerability in Nginx's HTTP chunked transfer encoding parser. Under the conditions targeted by this laboratory environment, the vulnerabilit...

squid: squid: Request Smuggling in HTTP Transfer-Encoding

A flaw was found in Squid. Due to improper handling of HTTP/1.1 Transfer-Encoding headers, a trusted client can perform an HTTP request smuggling attack, interfering with how web requests are processed. This vulnerability allows an attacker to bypass intermediate security controls. When an HTTP...

Important: Red Hat Security Advisory: squid security update

An update for squid is now available for Red Hat Enterprise Linux 9.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

RHEL 9 : squid (RHSA-2026:99124)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:99124 advisory. Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects. Security Fixes: squid: squid: Request...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: squid (UTSA-2026-152893)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-152893 advisory. Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggli...

MiracleLinux 8 : squid:4 libecap-1.0.1-2.module+el8+2081+6b69e428, squid-4.15-10.module+el8+2081+6b69e428.13 (AXSA:2026-2311:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2311:01 advisory. squid: squid: Request Smuggling in HTTP Transfer-Encoding CVE-2026-61642 Tenable has extracted the preceding description block directly from the MiracleLinux...

Important: Red Hat Security Advisory: squid security update

An update for squid is now available for Red Hat Enterprise Linux 10.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

squid: squid: Request Smuggling in HTTP Transfer-Encoding

A flaw was found in Squid. Due to improper handling of HTTP/1.1 Transfer-Encoding headers, a trusted client can perform an HTTP request smuggling attack, interfering with how web requests are processed. This vulnerability allows an attacker to bypass intermediate security controls. When an HTTP...

CVE-2026-65833

iopress is a native HTTP server for Node.js with platform-specific async I/O. Prior to version 1.0.5, the chunked-transfer-encoding HTTP request parser in @iopress/core reads past the end of the input buffer when a request declares a chunk size larger than the body actually received. This results...