CVE-2026-19113 Unauthenticated denial of service via unbounded request body processing

Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, i...

CVE-2026-70646

aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...

httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies

A flaw was found in httplib2, a Python HTTP client library. This vulnerability allows a malicious or compromised HTTP server to send a small compressed data payload that, when decompressed by httplib2, expands to an extremely large size in memory. This unbounded decompression can lead to a Denial...

CVE-2026-67318

A flaw was found in axios, a popular JavaScript library for making HTTP requests. When using the Node.js HTTP/2 adapter, axios fails to properly enforce the configured maxBodyLength limit for streamed request bodies. This allows a remote attacker, by controlling the input stream, to send an...

CVE-2026-67318

axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on...

EUVD-2026-51827

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...

httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies

A flaw was found in httplib2, a Python HTTP client library. This vulnerability allows a malicious or compromised HTTP server to send a small compressed data payload that, when decompressed by httplib2, expands to an extremely large size in memory. This unbounded decompression can lead to a Denial...

SUSE CVE-2026-48824

Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw CVE-2026-45710, "Mailpit: Set a default 50MB p/m limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes" wrapped only POST /api/v1/send with http.MaxBytesReader. The...

CVE-2026-44613 Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling

Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...

axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter

A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If...

PT-2026-66502

Name of the Vulnerable Software and Affected Versions Apache Zeppelin versions 0.6.0 through 0.12.0 Description A Cross-Site Request Forgery CSRF issue exists due to a default CORS Cross-Origin Resource Sharing configuration that permits cross-origin state-changing requests and accepts text/plain...

CVE-2026-57834 Apache Traffic Server: Malformed chunked message body allows request smuggling

Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue...

CVE-2026-57834

Summary: Apache Traffic Server is affected by a vulnerability where request smuggling is possible when chunked messages are malformed. This affects versions 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3. The issue is fixed in 9.2.15 and 10.1.4. Impact indicators in the sources show high severity (...

CVE-2026-59921

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without...

CVE-2026-66752

tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-Encoding header with any value, including non-chunked codings, which causes the library to unconditionally apply chunk-decoding and discard...

EUVD-2026-49881

tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-Encoding header with any value, including non-chunked codings, which causes the library to unconditionally apply chunk-decoding and discard...

CVE-2026-66752

CVE-2026-66752 affects tiny-http up to version 0.12.0. The vulnerability stems from HTTP request handling where Transfer-Encoding is parsed inconsistently, causing the library to unconditionally apply chunk-decoding while Content-Length may be ignored. This mismatch between tiny_http’s parsing an...

CVE-2026-64647 Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the...

CVE-2026-64647

Summary: Next.js versions affected include 12.0.0–15.5.20 and 16.0.0–16.2.10. A server-side fetch with a request body can return a cached response body from a different request to the same URL when the request body uses a non-UTF-8 charset, causing confidential data in the POST response to leak t...

CVE-2026-64647 Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the...