SUSE CVE-2026-103399

A flaw was found in SoupServer libsoup. When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final non-1xx response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-aliv...

CVE-2026-103399

A flaw was found in SoupServer libsoup. When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final non-1xx response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-aliv...

CVE-2026-103399 Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body

A flaw was found in SoupServer libsoup. When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final non-1xx response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-aliv...

CVE-2026-103399 Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body

A flaw was found in SoupServer libsoup. When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final non-1xx response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-aliv...

CVE-2026-103399

A vulnerability exists in SoupServer (libsoup) where an HTTP/1.x client sending a request with Expect: 100-continue and a request body can trigger request smuggling . If the server returns an early final (non-1xx) response before reading the body, it fails to drain the bytes or close the connecti...

PT-2026-103492

Name of the Vulnerable Software and Affected Versions SoupServer libsoup affected versions not specified Description An issue exists where SoupServer fails to drain declared body bytes or close the connection when an HTTP/1.x client sends a request containing a request body and the Expect:...

CVE-2026-103399: Inconsistent Interpretation of HTTP Requests

A flaw was found in SoupServer libsoup. When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final non-1xx response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-aliv...

CVE-2026-103399: Inconsistent Interpretation of HTTP Requests

A flaw was found in SoupServer libsoup. When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final non-1xx response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-aliv...

Linux Distros Unpatched Vulnerability : CVE-2026-103399

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SoupServer libsoup. When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early...

CVE-2026-67173

Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to supply crafted graph data could set an image path to a malicious URI. When a victim rendered the affected graph, the browser could resolve th...

CVE-2025-42923

Due to insufficient CSRF protection in SAP Fiori App Manage Work Center Groups, an authenticated user could be tricked by an attacker to send unintended request to the web server. This has low impact on integrity and no impact on confidentiality and availability of the application...

CVE-2024-45258

The req package before 3.43.4 for Go may send an unintended request when a malformed URL is provided, because cleanHost in http.go intentionally uses a "garbage in, garbage out" design...

CVE-2024-45258

The req package before 3.43.4 for Go may send an unintended request when a malformed URL is provided, because cleanHost in http.go intentionally uses a "garbage in, garbage out" design...

CVE-2024-45258

The req package before 3.43.4 for Go may send an unintended request when a malformed URL is provided, because cleanHost in http.go intentionally uses a "garbage in, garbage out" design...

microweber cross-site request forgery vulnerability (CNVD-2022-12800)

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A cross-site request forgery vulnerability exists in microweber because the product does...

firefly-iii Cross-site Request Forgery Vulnerability (CNVD-2022-19846)

firefly-iii is a free and open source personal finance software. firefly-iii suffers from a cross-site request forgery vulnerability, which originates when a WEB application does not sufficiently validate that a request is from a trusted user, and can be exploited by an attacker to send an...

Firefly-III Cross-Site Request Forgery Vulnerability

firefly-iii is a free and open source personal finance software. firefly-iii suffers from a cross-site request forgery vulnerability, which originates when a WEB application does not sufficiently validate that a request is from a trusted user, and can be exploited by an attacker to send an...

Mattermost Server Cross-Site Request Forgery Vulnerability

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A cross-site request forgery vulnerability exists in Mattermost Server, which stems from a WEB application that does not adequately validate whether a request is coming from a trusted user, and can ...

Cross-site Request Forgery Vulnerability in Multiple NETGEAR Products (CNVD-2021-59156)

NETGEAR JNR1010 and others are a wireless router from NETGEAR USA. A cross-site request forgery vulnerability exists in multiple NETGEAR products. The vulnerability stems from the WEB application not adequately verifying that the request is from a trusted user. An attacker could use the...

Cross-site Request Forgery Vulnerability in Multiple NETGEAR Products (CNVD-2021-59162)

NETGEAR WAC505 and others are a wireless access point AP from NETGEAR, Inc. A cross-site request forgery vulnerability exists in several NETGEAR products. The vulnerability stems from the WEB application not adequately verifying that the request is from a trusted user. An attacker could use the...