3283 matches found
EulerOS 2.0 SP11 : nghttp2 (EulerOS-SA-2026-4258)
According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...
CVE-2026-107820
The x64dbg-MCP Server (prior to version 1.2 ) is vulnerable to a pre-authentication denial of service due to an integer overflow in src/core/mcp_server.zig. The parseContentLength() function fails to bound the Content-Length value, which is subsequently used in an unchecked usize addition within ...
CVE-2026-107820 x64dbg-MCP Server vulnerable to pre-authentication denial of service through Content-Length integer overflow
x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.2, src/core/mcpserver.zig parses an unbounded Content-Length value in parseContentLength and uses it in unchecked usize addition in wsRecv before token...
CVE-2026-107820 x64dbg-MCP Server vulnerable to pre-authentication denial of service through Content-Length integer overflow
x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.2, src/core/mcpserver.zig parses an unbounded Content-Length value in parseContentLength and uses it in unchecked usize addition in wsRecv before token...
MGASA-2026-0474 Updated capnproto package fixes security vulnerabilities
A negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead CVE-2026-32239. When using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer CVE-2026-32240...
CLEANSTART-2026-HI60053 undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response
CVE-2026-16728 affects multiple packages. undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. See references for individual vulnerability details...
netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers
A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both Transfer-Encoding: chunked and Content-Length headers. While Netty correctly strips the conflicting Content-Length header for HTTP/1.1 messages, thi...
CVE-2026-77802
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...
CVE-2026-77802
Progress Telerik Fiddler Classic for Windows versions prior to v6.0.20262.10021 are vulnerable to HTTP request smuggling in the proxy request forwarding component. The issue arises because the software forwards requests with multiple conflicting Content-Length headers verbatim, while only using t...
EUVD-2026-92425
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...
Astra Linux – Vulnerability in Puma
Puma is a Ruby/Rack web server designed for parallelism. Prior to versions 6.3.1 and 5.6.7, Puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers, which could allow HTTP request smuggling. The severity of this issue depends heavily ...
Astra Linux – Vulnerability in Netty
The HttpObjectDecoder.java file in Netty before version 4.1.44 allowed a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header...
Astra Linux – Vulnerability in libproxy
In libproxy, the url.cpp module in version 0.4.15 is vulnerable to a buffer overflow when PAC is enabled. This vulnerability was confirmed by using a large PAC file that was sent without a Content-length header...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nfconntracksip – Fixed the issue where Content-Length values exceeding UINTMAX were truncated before calculating the SIP message boundary. In siphelptcp, the Content-Length header is parsed using simplestrtoul. This...
Astra Linux – Vulnerability in Python 3.11
When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially leading to Out-of-Memory errors or other types of...
Astra Linux – Vulnerability in Jetty9
Jetty is a Java-based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepted the + character that followed the content-length value in an HTTP/1 header field. This was more permissive than what is allowed by the RFC, and other servers routinely...
Astra Linux – Vulnerability in HAPProxy
HAProxy versions 2.0.32, 2.1.x, and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 send empty Content-Length headers, violating section 8.6 of RFC 9110. In rare cases, an HTTP/1 server behind HAPProxy may interpret...
CVE-2026-77802: Inconsistent Interpretation of HTTP Requests
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...
CLEANSTART-2026-HZ65290 Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Content Length header
Security vulnerability affects the consul package. Consul and Consul Enterprise’s “Consul” event endpoint is vulnerable to denial of service DoS due to lack of maximum value on the Content Length header...