UBUNTU-CVE-2026-81038

The Object Transfer Service server builds its Object Action Control Point OACP response indication in oacpindsend subsys/bluetooth/services/ots/otsoacp.c. Before this fix the four-byte Checksum Value field was appended whenever the requested op code was BTGATTOTSOACPPROCCHECKSUMCALC, regardless o...

EUVD-2026-109972

The Object Transfer Service server builds its Object Action Control Point OACP response indication in oacpindsend subsys/bluetooth/services/ots/otsoacp.c. Before this fix the four-byte Checksum Value field was appended whenever the requested op code was BTGATTOTSOACPPROCCHECKSUMCALC, regardless o...

CVE-2026-98886

A flaw was found in the Linux kernel's gma500 graphics driver. This vulnerability can lead to a Denial of Service DoS when communicating over the display interface. Specifically, the driver ignores timeout and interruption signals while waiting for an HDMI High-Definition Multimedia Interface I2C...

httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi

A flaw was found in the modproxyuwsgi module of Apache HTTP Server. This issue allows HTTP response smuggling when the server processes a crafted uWSGI response containing a Transfer-Encoding header. A remote attacker can exploit this vulnerability to desynchronize HTTP communications, potentiall...

CVE-2026-116194

A flaw was found in rclone. A remote attacker could redirect file transfers and expose sensitive data by exploiting a Cross-Site Request Forgery CSRF vulnerability in the pCloud storage backend. During authorization, the local authentication callback service fails to validate the session state an...

MOVEit Transfer - SQL Injection

In Progress MOVEit Transfer before 2021.0.8 13.0.8, 2021.1.6 13.1.6, 2022.0.6 14.0.6, 2022.1.7 14.1.7, and 2023.0.3 15.0.3, a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit...

PT-2026-125103

Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.6.0 Description Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte...

Zephyr Project Zephyr improper exception handling vulnerability

A security vulnerability exists in Zephyr Project versions 3.3.0 through 4.4.2. It arises when the Object Transfer Service server, in oacpindsend, calls netbufsimplepullle32 on an uninitialized four-byte stack buffer via a failed path. Since OACP features require no pairing, encryption, or...

PT-2026-123417

The Object Transfer Service server builds its Object Action Control Point OACP response indication in oacp ind send subsys/bluetooth/services/ots/ots oacp.c. Before this fix the four-byte Checksum Value field was appended whenever the requested op code was BT GATT OTS OACP PROC CHECKSUM CALC,...

libevent: Fix of 6 CVEs

CVE-2026-63382: reject ambiguous Transfer-Encoding/Content-Length headers and require CRLF in chunked framing...

nodejs-http-transfer-encoding-smuggling-poc

nodejs-http-transfer-encoding-smuggling-poc PoC of HTTP Request Smuggling in nodejs CVE-2020-8287 src/index.js header: 'Host', '127.0.0.1', 'Transfer-Encoding', 'chunked', 'Transfer-Encoding', 'eee' , body: 'A' header: 'Host', '127.0.0.1' , body: '' data: 'HTTP/1.1 200 OK\r\n' + 'Date: Tue, 05 Ja...

p5-Starman -- multiple vulnerabilities

Starman project reports: SECURITY Stream chunked request bodies to the temporary buffer instead of holding whole chunks in memory CVE-2026-115824 Parse chunk-size lines in linear time with a 4 KiB length limit and strict syntax; malformed lines get 400 CVE-2026-115822 Do not send a response body...

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability that could allow HTTP request smuggling (CVE-2026-2332).

Summary IBM Storage Protect Server uses the Eclipse Jetty HTTP library in certain components. A vulnerability in Jetty's HTTP/1.1 chunked transfer encoding parser could allow HTTP request smuggling through specially crafted chunk extensions. Due to improper handling of malformed quoted strings...

CLSA-2026-1792806435 Fix CVE(s): CVE-2026-61642

SECURITY UPDATE: request smuggling via Transfer-Encoding: identity - debian/patches/CVE-2026-61642.patch: reject Transfer-Encoding: identity - CVE-2026-61642...

Medium: libsoup3

Issue Overview: A flaw was found in SoupServer libsoup. When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final non-1xx response before the body is read, the server neither drains the declared body bytes nor closes the connection...

EUVD-2026-109145

The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/devicenext/class/bthci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bthcitxsyncin allocated that buffer from bthcieppool, a fixed pool whose slots are only...

CVE-2026-99019

In the Linux kernel, the following vulnerability has been resolved: scsi: ch: Do not keep references to data transfer element devices chreadconfig looks up the scsidevice of every data transfer element whose SCSI id the changer reports in READ ELEMENT STATUS, and stores it in ch-dt...

OESA-2026-4503 python-urllib3 security update

Sanity-friendly HTTP client for Python Security Fixes: urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or...

OESA-2026-4502 python-urllib3 security update

Sanity-friendly HTTP client for Python Security Fixes: urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or...

OESA-2026-4501 python-urllib3 security update

Sanity-friendly HTTP client for Python Security Fixes: urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or...