Web-Cache-Vulnerability-Scanner

Web Cache Vulnerability Scanner WCVS is a fast and versatile CLI scanner for web cache poisoning and web cache deception developed by Hackmanit and Maximilian Hildebrand. The scanner supports many different web cache poisoning and web cache deception techniques, includes a crawler to identify...

param-miner

param-miner This extension identifies hidden, unlinked parameters. It's particularly useful for finding web cache poisoning vulnerabilities. It combines advanced diffing logic from Backslash Powered Scanner with a binary search technique to guess up to 65,000 param names per request. Param names...

CVE-2026-85254

A flaw was found in Apache Camel's Platform HTTP component. The mechanism designed to prevent request headers from being reflected into HTTP responses improperly compares header names using case-sensitive checks. A remote attacker can exploit this behavior by varying header name casing or sending...

CVE-2026-120633

A flaw was found in perl-CGI. This vulnerability allows a remote attacker to conduct web cache poisoning or redirect users to malicious websites by sending crafted Hypertext Transfer Protocol HTTP requests with untrusted host headers. Because the module trusts client-provided headers such as...

CVE-2026-11101-HTTP-Cache-Poisoning-via-Unkeyed-Query-Parameter

CVE-2026-11101 – HTTP Cache Poisoning via Unkeyed Query Parameter Overview A web cache uses only the URL path as the cache key, ignoring query parameters. An attacker can append a malicious payload to an unkeyed parameter e.g., utmcampaign and poison the cache. Subsequent visitors receive the...

OESA-2026-4583 squid security update

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests. Security Fixes: Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper...

OESA-2026-4582 squid security update

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests. Security Fixes: Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper...

OESA-2026-4581 squid security update

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests. Security Fixes: Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper...

OESA-2026-4580 squid security update

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests. Security Fixes: Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper...

AlmaLinux 9.6 [TuxCare] Security Update: squid (ALMALINUX9.6:CLSA-2026:1793281224)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793281224 advisory. - Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is...

Rocky Linux 9.6 [TuxCare] Security Update: squid (ALMALINUX9.6:CLSA-2026:1793281224)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793281224 advisory. - Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is...

CVE-2026-111750

A flaw was found in aiohttp. When running with the pure Python parser instead of compiled extensions, the parser accepts ambiguous HTTP Hypertext Transfer Protocol request framing. An unauthenticated remote attacker could exploit this flaw by sending specially crafted requests through an...

Astra Linux – vulnerability in python-django, python2.7

Packages python/cpython versions 0 through 3.6.13, 3.7.0 through 3.7.10, 3.8.0 through 3.8.8, and 3.9.0 through 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parseqsl and urllib.parse.parseqs. This vulnerability exploits a technique known as “parameter cloaking.” When an attacker i...

Astra Linux – Vulnerability in python-bottle

Packages from versions 0 and before 0.12.19 are vulnerable to Web Cache Poisoning, due to a mechanism called “parameter cloaking”. When attackers can separate query parameters using a semicolon ;, they can create a discrepancy in the interpretation of requests between the proxy running with defau...

SUSE CVE-2026-61642

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing src/HttpHeader.cc accepted the bare Transfer-Encoding: identity...

AZL-108531 CVE-2026-61642 affecting package squid 6.13-5

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing src/HttpHeader.cc accepted the bare Transfer-Encoding: identity...

CVE-2026-61642

The Squid caching proxy is vulnerable to an HTTP Request Smuggling attack due to an improper enforcement of behavioral workflow in its HTTP/1.1 Transfer-Encoding handling. Specifically, the header parsing logic in src/HttpHeader.cc incorrectly accepted the bare Transfer-Encoding: identity form, w...

CVE-2026-61642 Squid Request Smuggling in HTTP Transfer-Encoding

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing src/HttpHeader.cc accepted the bare Transfer-Encoding: identity...

PT-2026-122255

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing src/HttpHeader.cc accepted the bare Transfer-Encoding: identity...

CVE-2026-61642: Inconsistent Interpretation of HTTP Requests

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing src/HttpHeader.cc accepted the bare Transfer-Encoding: identity...