Imperva_gzip_bypass

Imperva 웹 애플리케이션 방화벽WAF POST 요청 우회 Imperva Cloud WAF는 악성 HTTP POST 페이로드log4j 익스플로잇, SQL 인젝션, 명령 실행, 디렉토리 트래버설, XXE 등를 전송할 때 공격자가 WAF 규칙을 우회할 수 있는 취약점이 있었습니다. 해결 방법 Imperva 팀은 보고를 받은 즉시 이를 매우 진지하게 받아들였으며, 단 며칠 만에 글로벌 수정을 완료했습니다. Kudos. Cloud WAF의 모든 고객은 2021년 12월 22일 기준으로 자동 패치되었습니다. Imperva는 협력하기...

EUVD-2026-20914

A gzip decompression bomb vulnerability exists when Orthanc processes HTTP request with Content-Encoding: gzip. The server does not enforce limits on decompressed size and allocates memory based on attacker-controlled compression metadata. A specially crafted gzip payload can trigger excessive...

CVE-2026-28435

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib httplib.h does not enforce Server::setpayloadmaxlength on the decompressed request body when using HandlerWithContentReader streaming ContentReader with Content-Encoding: gzip or other...

Internet Bug Bounty: CVE-2025-0725: Heap overflow in curl with Content-Encoding gzip and old libz versions

A vulnerability was reported in the curl project, where a heap overflow could be triggered by a malicious HTTP server serving abnormally large gzip headers. The vulnerability was caused by an integer overflow in curl's support for old libz versions when the Content-Encoding: gzip header was used...

CVE-2021-45468

Imperva Web Application Firewall WAF before 2021-12-23 allows remote unauthenticated attackers to use "Content-Encoding: gzip" to evade WAF security controls and send malicious HTTP POST requests to web servers behind the WAF...