Imperva_gzip_WAF_Bypass

Imperva Web Application Firewall WAF POSTリクエストバイパス Imperva Cloud WAFは、log4jエクスプロイト、SQLインジェクション、コマンド実行、ディレクトリトラバーサル、XXEなどの悪意のあるHTTP POSTペイロードを送信する際に、攻撃者がWAFルールを回避できるようにするバイパスに対して脆弱でした。 修復策 Impervaのチームは、報告を受けた瞬間からこの問題を非常に真剣に受け止め、わずか数日でグローバルな修正を完了させました。素晴らしい対応です。Cloud...

Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

ImpactWho is impacted: - Any application using Zapros to make HTTP requests to untrusted servers - Applications that follow redirects to attacker-controlled hostsAttack vector: - A malicious HTTP server returns a response with many chained content encodings. When the client attempts to decode, it...

undici vulnerable to Denial of Service via unbounded decompression of compressed responses

Impact The interceptors.decompress interceptor decompresses HTTP response bodies according to the untrusted Content-Encoding header. The number of decompression layers is capped at 5, but the total decompressed output size is not bounded and there is no option to limit it. A malicious or faulty...

EUVD-2026-71634

undici vulnerable to Denial of Service via unbounded decompression of compressed responses...

CVE-2026-28318-check

SolarWinds Serv-U 인증되지 않은 DoS: 안전한 탐지 스크립트 안전하고 파괴적이지 않은 탐지기로 CVE-2026-28318 에 대한 것입니다. SolarWinds Serv-U = 15.5.4.125. 취약하지 않음. 응답했지만 Serv-U Server 헤더 없음| NOT-SERV-U not-servu| Serv-U 서버가 아니거나 프...

Imperva_gzip_bypass

Imperva 웹 애플리케이션 방화벽WAF POST 요청 우회 Imperva Cloud WAF는 악성 HTTP POST 페이로드log4j 익스플로잇, SQL 인젝션, 명령 실행, 디렉토리 트래버설, XXE 등를 전송할 때 공격자가 WAF 규칙을 우회할 수 있는 취약점이 있었습니다. 해결 방법 Imperva 팀은 보고를 받은 즉시 이를 매우 진지하게 받아들였으며, 단 며칠 만에 글로벌 수정을 완료했습니다. Kudos. Cloud WAF의 모든 고객은 2021년 12월 22일 기준으로 자동 패치되었습니다. Imperva는 협력하기...

servu-cve-2026-28318-poc

CVE-2026-28318 — SolarWinds Serv-U "Content-Encoding: deflate" 事前認証クラッシュ 根本原因分析 + DoS 概念実証。 公開アドバイザリでは、これを認証不要の denial-of-service / uncontrolled resource consumption として分類しています。バイナリ解析の結果、根本的な欠陥は メモリ安全性 に関わるもので、HTTP deflate デコードパスにおける 無効なfree による内部ポインタの解放 であり、プロセスヒープを破壊します STATUSHEAPCORRUPTION,...

openSUSE 16: httpcomponents-client / httpcomponents-client-cache / etc (openSUSE-SU-2026:21894-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21894-1 advisory. This update for httpcomponents-client fixes the following issue: - CVE-2026-64607: improper release of underlying connection back to connection manager...

Security Bulletin: HttpClient based on the classic i/o model fails to correctly release the underlying connection

Summary HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the...

org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak

A flaw was found in Apache HttpComponents Client, specifically in its classic input/output I/O model. When processing a response message with an invalid or unsupported Content-Encoding header, the client fails to properly release the underlying network connection. This connection leak can lead to...

GHSA-5VJJ-2R48-Q622 Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Impact Who is impacted: - Any application using Zapros to make HTTP requests to untrusted servers - Applications that follow redirects to attacker-controlled hosts Attack vector: - A malicious HTTP server returns a response with many chained content encodings. When the client attempts to decode, ...

Allocation of Resources Without Limits or Throttling

Overview zapros is a Modern and extensible HTTP client for Python. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via getcontentdecoder in src/zapros/models.py, where an attacker can send an HTTP response with an unbounded number of...

Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Impact Who is impacted: - Any application using Zapros to make HTTP requests to untrusted servers - Applications that follow redirects to attacker-controlled hosts Attack vector: - A malicious HTTP server returns a response with many chained content encodings. When the client attempts to decode, ...

EUVD-2026-84182

Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service...

BIT-NIFI-2026-70469 Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests

Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instances of the Content-Encoding header and d...

CVE-2026-61541

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to...

CVE-2026-61541

Zapros , a Python HTTP client, is vulnerable to denial of service in versions prior to 0.14.0 . The root cause is an unbounded chained Content-Encoding decompression chain : when an application requests content from an untrusted server (or follows a redirect to one), a malicious response containi...

CVE-2026-61541 Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to...

CVE-2026-61541 Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to...

CVE-2026-61541 Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to...