CVE-2021-31166

CVE-2021-31166 الكشف عن محاولات استغلال CVE-2021-31166 ثغرة في مكدس بروتوكول HTTP قاعدة Suricata حزمة Zeek المراجع https://corelight.blog/2021/05/27/detecting-cve-2021-31166-http-vulnerability/ https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31166...

cve-2022-21907

تطبيق Golang لـ CVE-2022-21907 بواسطة 1vere$k CVE-2022-21907 - Double Free في برنامج تشغيل http.sys. ملخص هذا تطبيق Golang متعدد الخيوط يسمح بإرسال الطلبات إلى عدة أهداف في الوقت نفسه. ليس فعّالاً جداً مع طلبات POST لكنه يوفر ما يقارب 30% من السرعة مقارنةً بالطريقة الخطية. يمكن لمهاجم غير مصادق...

CVE-2021-31166

CVE-2021-31166 Pourquoi J'ai récemment écrit un exploit pour CVE-2021-31166, il exploite CVE-2021-31166 et CVE-2021-31166. Un pentester devrait utiliser https://github.com/mauricelambert/CVE-2021-31166, mais dans les équipes SOC, nous avons besoin de connaître la vulnérabilité spécifique pour la...

CVE-2022-21907-http.sys

CVE-2022-21907 - تحرير مزدوج في برنامج تشغيل http.sys CVE-2022-21907 - تحرير مزدوج في برنامج تشغيل http.sys ملخص يمكن لمهاجم غير مصادق إرسال طلب HTTP مع ترويسة طلب "Accept-Encoding" HTTP مما يؤدي إلى تحرير مزدوج double free في قائمة الترميز غير المعروفة داخل حزمة بروتوكول HTTP http.sys لمعالجة...

CVE-2021-31166-Exploit

CVE-2021-31166-Exploit استغلال لثغرة RCE في مكدس بروتوكول HTTP الخاص بمايكروسوفت CVE-2021-31166 طلب HTTP مصمم خصيصًا يستهدف إصدار ويندوز معرضًا للخطر سيؤدي إلى هجوم حجب الخدمة DoS. وسيتم إعادة تشغيل الخادم مع ظهور خطأ الشاشة الزرقاء. Http.sys هو برنامج تشغيل نواة ويندوز مسؤول عن معالجة طلبات HTTP...

📄 HTTP.sys HTTP/2 Denial of Service

This advisory provides simple proof of concept details to trigger the HTTP/2 denial of service condition related to malformed Accept-Encoding headers. Titles: CVE-2026-49160 - HTTP.sys HTTP/2 Denial of Service DoS Vulnerability Author: nu11secur1ty Date: 06/24/2026 Vendor: Microsoft Corporation...

WS-2020-0029

Versions of @hapi/accept prior to 3.2.4 or 5.0.1 are vulnerable to Denial of Service. The Accept-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors as opposed to...

EUVD-2026-18378

Rack has quadratic complexity in Rack::Utils.selectbestencoding via wildcard Accept-Encoding header...

UBUNTU-CVE-2026-34230

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.selectbestencoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard entries. Because this method is used by Rack::Deflater to choose a respon...

CVE-2026-34230 Rack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.selectbestencoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard entries. Because this method is used by Rack::Deflater to choose a respon...

Integer Overflow lead to DOS in handling Accept-Encoding header in API /v2/models/<model-name>/generate

This report is not public...

EUVD-2018-0581

Malware in sbrugna...

EUVD-2003-0833

Malware in sbrugna...

Incorrect Input Validation

Apache Traffic Server is vulnerable to Incorrect Input Validation. The vulnerability is caused due to Invalid Accept-Encoding header. This can lead to fail cache lookup and force forwarding requests...

The vulnerability of the Apache Traffic Server web server, related to insufficient input validation, allows attackers to execute arbitrary requests.

The vulnerability of the Apache Traffic Server web server is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary requests using the HTTP Accept-Encoding header...

DEBIAN-CVE-2024-35296

Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue...

UBUNTU-CVE-2024-35296

Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue...

PT-2024-5532 · Apache · Apache Traffic Server

Name of the Vulnerable Software and Affected Versions: Apache Traffic Server versions 8.0.0 through 8.1.10 Apache Traffic Server versions 9.0.0 through 9.2.4 Description: The issue is related to insufficient input validation, allowing a remote attacker to execute arbitrary requests using the HTTP...

GHSA-CQJG-WHMM-8GV6 Denial of Service via malformed accept-encoding header in hapi

Affected versions of hapi will crash or lock the event loop when a malformed accept-encoding header is recieved. Recommendation Update to version 16.1.1 or later...

CVE-2017-16013

hapi is a web and services application framework. When hapi = 15.0.0 = 16.1.0 encounters a malformed "accept-encoding" header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached...