CVE-2013-2028-Exploit

Exploit de CVE-2013-2028 Detalles de la vulnerabilidad Software vulnerable: Nginx 1.3.9 Función vulnerable: ngxhttpparsechunked CVE-2013-2028 es una vulnerabilidad de desbordamiento de entero en el analizador de codificación de transferencia fragmentada HTTP de Nginx. Bajo las condiciones objetiv...

CVE-2025-55315-detection-playground

Aquí hay algunas pruebas que se pueden realizar contra estos servicios para observar diferentes comportamientos en las rutas GET/POST entre las versiones parcheadas y no parcheadas de Kestrel. GET contra la versión no parcheada envía 200 y el socket permanece abierto printf 'GET / HTTP/1.1\r\nHos...

urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

Impacturllib3's streaming API is designed for efficiently handling large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When decoding a chunked-transfer-encoded response, this API reads each chunk's size field by buffering until ...

PYSEC-2026-4177 urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

Impact urllib3's streaming API is designed for efficiently handling large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When decoding a chunked-transfer-encoded response, this API reads each chunk's size field by buffering until...

urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

Impact urllib3's streaming API is designed for efficiently handling large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When decoding a chunked-transfer-encoded response, this API reads each chunk's size field by buffering until...

EUVD-2026-89017

urllib3: HTTPResponse.stream/readchunked buffers an unbounded chunk-size line into memory...

GHSA-VXQ7-64XX-V4GW urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

Impact urllib3's streaming API is designed for efficiently handling large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When decoding a chunked-transfer-encoded response, this API reads each chunk's size field by buffering until...

AlmaLinux 9.6 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc (ALMALINUX9.6:CLSA-2026:1787783675)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787783675 advisory. - A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts...

Rocky Linux 9.6 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc (ALMALINUX9.6:CLSA-2026:1787783675)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787783675 advisory. - A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accept...

CentOS Linux 7 [TuxCare] Security Update: libsoup / libsoup-devel (CENTOS7:CLSA-2026:1787751026)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1787751026 advisory. - A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inpu...

CVE-2026-73256

A flaw was found in Mongoose. A remote, unauthenticated attacker can achieve unauthorized access or bypass security controls through HTTP request smuggling. Due to an error in protocol version validation, Mongoose fails to identify HTTP/1.0 requests and incorrectly processes chunked transfer...

CVE-2025-55315-repro

CVE-2025-55315-repro Este repositorio contiene una pequeña aplicación de consola ASP.NET Core para reproducir y probar el comportamiento del análisis de transferencia fragmentada chunked y de nuevas líneas en HTTP. Más información sobre CVE-2025-55315. Contenido Repro/Program.cs: aplicación de...

undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service...

undertow-core: Undertow:HTTP request smuggling via oversized chunk-size bit overlap

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially...

undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service...

undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service...

io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/1.1 chunked transfer encoding extension values. Due to incorrect parsing of quoted strings, this flaw enables request smuggling attacks, potentially allowing an attacker to bypass...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wrapped the request body using BoundedIO when the CONTENTLENGTH header was present. When a multipart/form-data request was sent without a Content-Length header, such as with HTTP...

CVE-2026-90678

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer...

UBUNTU-CVE-2026-90678

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer...