EUVD-2026-94644

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, WebSocketHandler.upgrade aborts a handshake whose Sec-WebSocket-Accept value is missing or invalid but continues into pipeline installati...

CVE-2026-107284

The AsyncHttpClient (AHC) library for Java applications contains a vulnerability where WebSocketHandler.upgrade fails to properly terminate a handshake when the Sec-WebSocket-Accept value is missing or invalid. While the handshake is technically aborted, the library continues into pipeline instal...

CVE-2026-107284 AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, WebSocketHandler.upgrade aborts a handshake whose Sec-WebSocket-Accept value is missing or invalid but continues into pipeline installati...

PT-2026-107713

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, WebSocketHandler.upgrade aborts a handshake whose Sec-WebSocket-Accept value is missing or invalid but continues into pipeline installati...

CVE-2026-97626 Gitea profile feed disclosure bypassing user visibility

Requesting a user or organization profile page GET /username with an Accept: application/rss+xml or Accept: application/atom+xml header returned the owner's activity feed without the visibility check that the profile page and the .rss and .atom routes apply. Anonymous users, restricted users and...

CVE-2026-97626

In Gitea , a vulnerability exists where requesting a user or organization profile page (GET /{username}) with specific Accept headers (application/rss+xml or application/atom+xml) bypasses visibility checks. This allows anonymous users , restricted users , and non-members to confirm the existence...

DEBIAN-CVE-2026-84429

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An...

CVE-2026-84429

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An...

CVE-2026-84429 Potential denial-of-service vulnerability in HTTP header parsing

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An...

CVE-2026-84429 Potential denial-of-service vulnerability in HTTP header parsing

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An...

EUVD-2026-93417

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An...

CVE-2026-84429

The Django web framework is vulnerable to a potential denial-of-service (DoS) attack affecting versions 6.1 before 6.1.2 , 6.0 before 6.0.9 , and 5.2 before 5.2.18 . The root cause is quadratic time complexity in the django.utils.http.parse_header_parameters() function when parsing values contain...

CVE-2026-84429

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An...

PT-2026-106733

Name of the Vulnerable Software and Affected Versions Django versions prior to 6.1.2 Django versions prior to 6.0.9 Django versions prior to 5.2.18 Description A denial-of-service issue exists in the django.utils.http.parse header parameters function. The problem arises from quadratic time...

Linux Distros Unpatched Vulnerability : CVE-2026-84429

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential...

CVE-2019-5418

CVE-2019-5418: Ruby on Rails Path Traversal & Arbitrary File Read 이 프로젝트는 Ruby on Rails의 로컬 파일 포함 취약점CVE-2019-5418을 실습하고 재현하기 위한 환경입니다. 해당 취약점은 Accept 헤더를 통한 경로 탐색으로 서버 내부의 임의의 파일을 읽을 수 있는 취약점입니다. 취약점 요약 루비 온 레일즈Ruby on Rails는 개발자가 빠르고 쉽게 웹 애플리케이션을 구축할 수 있는 웹 애플리케이션 프레임워크입니다. Ruby on Rails 작업 뷰...

CVE-2021-31166-Exploit

CVE-2021-31166-익스플로잇 MS Http Protocol Stack RCE 취약점 CVE-2021-31166 익스플로잇 특별히 조작된 Http 요청이 취약한 윈도우 버전을 대상으로 하면 DOS 공격이 발생합니다. 그리고 서버는 블루 스크린 오류와 함께 재부팅됩니다. Http.sys는 http 요청을 처리하고 이에 대한 응답을 생성하는 윈도우 커널 드라이버입니다. 이 취약한 http.sys 드라이버는 조작된 "Accept-Encoding" 헤더를 처리할 수 없어 충돌이 발생합니다. 결과적으로 서버가 재부팅됩니다. 블루...

Astra Linux – Vulnerability in Jetty9

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, as well as 10.0.0 and 11.0.0, when Jetty handles a request containing multiple Accept headers with a large number of “quality” i.e., q parameters, the server may enter a Denial-of-Service DoS state due to high CPU usage in processing...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

A issue was discovered in the Linux kernel before version 6.6.8. The roseioctl function in net/rose/afrose.c has a use-after-free issue due to a race condition involving roseaccept...

USN-8865-1 edk2 vulnerabilities

It was discovered that EDK II incorrectly handled CMS key unwrapping in the embedded OpenSSL library. An attacker could possibly use this issue to cause a heap buffer overflow, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu...