CVE-2026-85717 AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

EUVD-2026-81905

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

CVE-2026-85717

CVE-2026-85717 affects the AsyncHttpClient (AHC) Java library, versions 2.14.5–2.16.0 and 3.0.9–3.0.11 . When a client is configured with a client-wide Realm and redirect following , the Interceptors authentication path falls back to the client configuration after redirect handling clears the per...

CVE-2026-85717

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

ios-nehelper-wifi-info-0day

Nehelper Wifi Info 0-day iOS 15.0 I've updated this code to avoid using Private API directly. Read more in my blog post. However, that means that now this code is iOS version-specific and possibly device model-specific. So if it doesn't work on your device, recalculate and update the offsets in c...

CVE-2026-85719 AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and 3.0.12, requests using an authenticated SOCKS proxy can expose the proxy's credentials to the origin because NettyRequestFactory and...

EUVD-2026-81904

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and 3.0.12, requests using an authenticated SOCKS proxy can expose the proxy's credentials to the origin because NettyRequestFactory and...

CVE-2026-85719 AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and 3.0.12, requests using an authenticated SOCKS proxy can expose the proxy's credentials to the origin because NettyRequestFactory and...

CVE-2026-85719

AsyncHttpClient (AHC) , a Java library for asynchronous HTTP requests, contains a credential-exposure flaw in its SOCKS proxy handling. NettyRequestFactory and NettyRequestSender attach the Proxy-Authorization header without verifying the request is actually being sent to an HTTP proxy, so creden...

CVE-2026-85719

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and 3.0.12, requests using an authenticated SOCKS proxy can expose the proxy's credentials to the origin because NettyRequestFactory and...

CVE-2026-85719 AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and 3.0.12, requests using an authenticated SOCKS proxy can expose the proxy's credentials to the origin because NettyRequestFactory and...

CVE-2026-72815-poc

CVE-2026-72815: go-chi/chi middleware.RealIP IP 欺骗 PoC English version 概述 本仓库是 go-chi/chi 的 middleware.RealIP 中存在的 IP 欺骗漏洞 CVE-2026-72815 （GHSA-3fxj-6jh8-hvhx）的本地概念验证（PoC）。 存在漏洞的 RealIP middleware 会无条件信任 X-Forwarded-For 的第一个（最左侧）值，并用该值覆盖 http.Request.RemoteAddr。在客户端可以指定 X-Forwarded-For...

CVE-2026-81868 Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

CVE-2026-81868 Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

EUVD-2026-81899

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

CVE-2026-81868

Steeltoe (open-source cloud-native application libraries) is vulnerable in Steeltoe.Security.Authorization.Certificate prior to version 4.3.0 . When using AddOrgAndSpacePolicies() and UseCertificateAuthorization(), the framework trusts the public certificate supplied in the X-Client-Cert request ...

CVE-2026-85715

ExifReader prior to 4.41.1 contains a denial-of-service vulnerability in the parsing of HEIC/AVIF ISO-BMFF files within getItems() in src/image-header-iso-bmff-iloc.js. The parser trusts itemCount and extentCount values from the iloc box; when offsetSize, lengthSize, baseOffsetSize, and indexSize...

CVE-2026-85715 ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion

ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems within src/image-header-iso-bmff-iloc.js and trusts iloc itemCount and extentCount values while allocating an extent object for every nested-loop...

EUVD-2026-81897

ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems within src/image-header-iso-bmff-iloc.js and trusts iloc itemCount and extentCount values while allocating an extent object for every nested-loop...

CVE-2026-85715 ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion

ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems within src/image-header-iso-bmff-iloc.js and trusts iloc itemCount and extentCount values while allocating an extent object for every nested-loop...