CVE-2023-54397

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain...

CVE-2023-54397

Tornado (Python web framework) versions before 6.3.3 are vulnerable to HTTP request smuggling caused by improper parsing of Content-Length headers that accept non-standard characters. An attacker can send crafted requests to bypass proxy validation and smuggle requests when Tornado is deployed be...

EUVD-2023-60690

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain...

CVE-2023-54397 Tornado before 6.3.3 HTTP Request Smuggling via Content-Length

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain...

CVE-2023-54397

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain...

CVE-2026-38427

CVE-2026-38427: Integer Wraparound → Heap Buffer Overflow in Tasmota fetchjpg CVE: CVE-2026-38427 Severity: Critical CVSS 9.8 Product: Arendst Tasmota Affected Version: = 15.3.0.3 File: tasmota/tasmotaxdrvdriver/xdrv10scripter.ino Function: fetchjpg — case 2 MJPEG frame fetch Author: Saidakbarxon...

CVE-2026-65838

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because...

CVE-2026-65838 Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because...

CVE-2026-65838 Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because...

CVE-2026-65838

Skipper , an HTTP router and reverse proxy, has a bypass in its OPA authorization filter prior to version 0.27.35 . The opaAuthorizeRequestWithBody filter uses ExtractHttpBodyOptionally, which leaves OPA with an empty parsed_body when an oversized Content-Length request exceeds the -open-policy-a...

Astra Linux – Vulnerability in Waitress

Waitress version 1.3.1 allows for the smuggling of requests by sending the Content-Length header twice. Waitress would fold the two Content-Length headers together, and since it cannot convert the now comma-separated values into integers, it internally sets the Content-Length to 0. If two...

Astra Linux – Vulnerability in Tomcat9

If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26, or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers by setting rejectIllegalHeader to false the default for 8.5.x only, Tomcat would not reject requests containing an invalid Content-Length header. This...

CVE-2026-90678

A flaw was found in HAProxy. A remote, unauthenticated attacker can exploit a vulnerability in the HTTP/3 multiplexer when processing requests without a Content-Length header, leading to HTTP request smuggling. This occurs when HAProxy is configured with QUIC support and an HTTP/3 frontend, and...

CVE-2022-45059-demo

CVE-2022-45059-demo Varnish Cache releases 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.1.0, 7.1.1 and 7.2.0 have a request smuggling vulnerability where an attacker can request that the content-length header is made hop-by-hop. This is a demo consisting of a Spring Boot web application running behind a...

SAPGateBreaker-Exploit

CVE-2022-22536: HTTP Smuggling Through SAP's Front Door SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepe...

w48crash

WebMod Stack Buffer Overflow CVE-2007-1260 by cybermind Kevin Masterson [email protected] WebMod site archived: https://web.archive.org/web/20080517044559/http://djeyl.net/w.php Vulnerable versions: 0.48, both Win32 and Linux. Previous versions may be vulnerable. This should work with any...

CVE-2026-54135

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service DoS via memory exhaustion OOM. In...

CVE-2026-54135

AirSane is a SANE frontend and scanner server supporting Apple's AirScan protocol. Versions prior to 0.4.12 are vulnerable to a remote, unauthenticated Denial of Service (OOM) in its custom HTTP server. The root cause lies in the HttpServer::Request::content function in httpserver.cpp, which read...

CVE-2026-54135 AirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP Server

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service DoS via memory exhaustion OOM. In...

CVE-2026-54135 AirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP Server

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service DoS via memory exhaustion OOM. In...