CVE-2026-108147

An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19. django.http.multipartparser.MultiPartParser is subject to excessive memory consumption when processing multipart file uploads with base64 Content-Transfer-Encoding, which could be buffered entirely ...

CVE-2026-108147: djangoproject Django: An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19

An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19. django.http.multipartparser.MultiPartParser is subject to excessive memory consumption when processing multipart file uploads with base64 Content-Transfer-Encoding, which could be buffered entirely ...

SUSE CVE-2026-115927

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to...

CVE-2026-111816

A flaw was found in Apache Traffic Server. Malformed HTTP 302 redirect responses containing chunked transfer encoding are improperly forwarded instead of being rejected as parse errors. A remote attacker can exploit this condition to cause HTTP response desynchronization and cache poisoning,...

CVE-2026-111809

A flaw was found in Apache Traffic Server. An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted HEAD requests containing Content-Length or Transfer-Encoding headers. This flaw enables HTTP request smuggling, where intermediate proxies and backend servers...

CVE-2026-66752-HTTP-Request-Smuggling-via-Unparsed-Transfer-Encoding-Values-tiny_http-

Security Advisory: HTTP Request Smuggling via Unparsed Transfer-Encoding Values tinyhttp Assigned CVE ID: CVE-2026-66752 Summary tinyhttp checks only whether a Transfer-Encoding header is present. It never looks at the value. Any value, including codings that are not chunked and coding lists whos...

CVE-2013-2028-Exploit

CVE-2013-2028 Exploit Vulnerability Details Vulnerable software: Nginx 1.3.9 Vulnerable function: ngxhttpparsechunked CVE-2013-2028 is an integer overflow vulnerability in Nginx's HTTP chunked transfer encoding parser. Under the conditions targeted by this laboratory environment, the vulnerabilit...

Apache2 - Transfer-Encoding Chunked XSS

Apache2 PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 contain a reflected cross-site scripting vulnerability caused by mishandling of chunked transfer-encoding requests in sapi/apache2handler/sapiapache2.c. Attackers can execute malicious scripts via crafted...

CVE-2025-55315-detection-playground

Here are some tests that can be performed against these services to observe different behavior on GET/POST routes between the patched and unpatched versions of Kestrel. GET against unpatched sends 200 and socket remains open printf 'GET / HTTP/1.1\r\nHost: localhost\r\nTransfer-Encoding:...

CVE-2026-67181-HTTP-Request-Smuggling-via-Transfer-Encoding-Desynchronization-rouille-

Security Advisory: HTTP Request Smuggling via Transfer-Encoding Desynchronization rouille Assigned CVE ID: CVE-2026-67181 Summary rouille::proxy::proxy forwards the client's Transfer-Encoding header to the backend unchanged, but writes the request body that tinyhttp has already de-chunked. It nev...

CVE-2020-25613

POC POST / HTTP/1.1 Host: 127.0.0.1:1080 Content-Type: text/html Content-Length: 129 Connection: keep-alive Transfer-Encoding: 0xb chunked 1 A 0 POST /flag HTTP/1.1 Host: 127.0.0.1:1080 Content-Length: 180 Connection: keep-alive Content-Type: text/html URI:...

CVE-2026-55614

uhttpd is a small HTTP server. In unpatched repository snapshots, clientparseheader in client.c lowercases header names but compares the Transfer-Encoding value to chunked using case-sensitive strcmp. A mixed-case transfer-coding token is accepted without enabling r-transferchunked, despite...

EUVD-2026-114562

uhttpd is a small HTTP server. In unpatched repository snapshots, clientparseheader in client.c lowercases header names but compares the Transfer-Encoding value to chunked using case-sensitive strcmp. A mixed-case transfer-coding token is accepted without enabling r-transferchunked, despite...

CVE-2026-55614 uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching

uhttpd is a small HTTP server. In unpatched repository snapshots, clientparseheader in client.c lowercases header names but compares the Transfer-Encoding value to chunked using case-sensitive strcmp. A mixed-case transfer-coding token is accepted without enabling r-transferchunked, despite...

CVE-2026-55614 uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching

uhttpd is a small HTTP server. In unpatched repository snapshots, clientparseheader in client.c lowercases header names but compares the Transfer-Encoding value to chunked using case-sensitive strcmp. A mixed-case transfer-coding token is accepted without enabling r-transferchunked, despite...

CLEANSTART-2024-MD01325 Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1

Security vulnerability affects the go package. Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1...

CVE-2026-91920

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size ...

DEBIAN-CVE-2026-91920

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size ...

EUVD-2026-113473

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size ...

PT-2026-133234

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size ...