CVE-2022-21907-http.sys

CVE-2022-21907 - Double Free in http.sys driver CVE-2022-21907 - Double Free in http.sys driver Summary An unauthenticated attacker can send an HTTP request with an "Accept-Encoding" HTTP request header triggering a double free in the unknown coding-list inside the HTTP Protocol Stack http.sys to...

CVE-2021-31166

CVE-2021-31166 Detection of attempts to exploit CVE-2021-31166 HTTP Protocol Stack vulnerability Suricata rule Zeek Package References https://corelight.blog/2021/05/27/detecting-cve-2021-31166-http-vulnerability/ https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31166...

CVE-2021-31166-Exploit

CVE-2021-31166-Exploit Exploit for MS Http Protocol Stack RCE vulnerability CVE-2021-31166 A specially crafted Http request targetting a vulnerable windows version will result into DOS attack. And the server will be rebooted with blue screen error. Http.sys is a windows kernel driver responsible...

CVE-2021-31166

CVE-2021-31166 Why I recently wrote an exploit for CVE-2021-31166, it exploit CVE-2021-31166 and CVE-2021-31166. A pentester should use https://github.com/mauricelambert/CVE-2021-31166, but in SOC teams we need to know the specific vulneraility to fix it properly, which is why i wrote this exploi...

cve-2022-21907

CVE-2022-21907 Golang Application by 1vere$k CVE-2022-21907 - Double Free in http.sys driver. Summary This is a multithreading Golang application wich allows make requests on few targets simultaneously. Not very productive with the POST requests but it provides nearly 30% of speed comparing to a...

📄 HTTP.sys HTTP/2 Denial of Service

This advisory provides simple proof of concept details to trigger the HTTP/2 denial of service condition related to malformed Accept-Encoding headers. Titles: CVE-2026-49160 - HTTP.sys HTTP/2 Denial of Service DoS Vulnerability Author: nu11secur1ty Date: 06/24/2026 Vendor: Microsoft Corporation...

WS-2020-0029

Versions of @hapi/accept prior to 3.2.4 or 5.0.1 are vulnerable to Denial of Service. The Accept-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors as opposed to...

EUVD-2026-18378

Rack has quadratic complexity in Rack::Utils.selectbestencoding via wildcard Accept-Encoding header...

UBUNTU-CVE-2026-34230

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.selectbestencoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard entries. Because this method is used by Rack::Deflater to choose a respon...

CVE-2026-34230 Rack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.selectbestencoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard entries. Because this method is used by Rack::Deflater to choose a respon...

Integer Overflow lead to DOS in handling Accept-Encoding header in API /v2/models/<model-name>/generate

This report is not public...

EUVD-2018-0581

Malware in sbrugna...

EUVD-2003-0833

Malware in sbrugna...

Incorrect Input Validation

Apache Traffic Server is vulnerable to Incorrect Input Validation. The vulnerability is caused due to Invalid Accept-Encoding header. This can lead to fail cache lookup and force forwarding requests...

Apache Traffic Server Arbitrary Request Execution

The vulnerability of the Apache Traffic Server web server is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary requests using the HTTP Accept-Encoding header...

DEBIAN-CVE-2024-35296

Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue...

UBUNTU-CVE-2024-35296

Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue...

PT-2024-5532 · Apache · Apache Traffic Server

Name of the Vulnerable Software and Affected Versions: Apache Traffic Server versions 8.0.0 through 8.1.10 Apache Traffic Server versions 9.0.0 through 9.2.4 Description: The issue is related to insufficient input validation, allowing a remote attacker to execute arbitrary requests using the HTTP...

GHSA-CQJG-WHMM-8GV6 Denial of Service via malformed accept-encoding header in hapi

Affected versions of hapi will crash or lock the event loop when a malformed accept-encoding header is recieved. Recommendation Update to version 16.1.1 or later...

CVE-2017-16013

hapi is a web and services application framework. When hapi = 15.0.0 = 16.1.0 encounters a malformed "accept-encoding" header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached...