CVE-2026-88038 cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...

GHSA-MP55-P8C9-RFW2 Hackney has CRLF / header injection via unvalidated `domain` and `path` options

Summary CRLF injection in hackneycookie:setcookie/3 src/hackneycookie.erl. The function validates Name and Value against CR/LF and control characters but concatenates the domain and path options verbatim into the output binary. If either option carries attacker-controlled data, a Host header...

Hackney has CRLF / header injection via unvalidated `domain` and `path` options

Summary CRLF injection in hackneycookie:setcookie/3 src/hackneycookie.erl. The function validates Name and Value against CR/LF and control characters but concatenates the domain and path options verbatim into the output binary. If either option carries attacker-controlled data, a Host header...

algernon 安全漏洞

Algernon is a web server developed by Alexander F. Rødseth. Versions of Algernon prior to 1.17.8 contained security vulnerabilities. These vulnerabilities stemmed from path traversal via the Host header when using the --domain option, potentially allowing arbitrary file reading, directory listing...

CVE-2026-47069

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in benoitc hackney allows HTTP Response Splitting. The hackneycookie:setcookie/3 function in src/hackneycookie.erl validates the Name and Value arguments against CRLF and control characters, but concatenates the domain and...

CVE-2026-47069

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in benoitc hackney allows HTTP Response Splitting. The hackneycookie:setcookie/3 function in src/hackneycookie.erl validates the Name and Value arguments against CRLF and control characters, but concatenates the domain and...

Insecure Cookie

csrf-csrf is vulnerable to insecure cookies. The vulnerability exists because the default cookie name is prefixed with Host instead of Host-, allowing an attacker to send insecure cookies from an incorrect domain when no domain option is provided in the cookie options...

DEBIAN-CVE-2011-2716

The DHCP client udhcpc in BusyBox before 1.20.0 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in the 1 HOSTNAME, 2 DOMAINNAME, 3 NISDOMAIN, and 4 TFTPSERVERNAME host name options...

TFTPD32 DNS Server 4.00 - Denial of Service

Title: Tftpd32 DNS Server Denial Of Service Vulnerability Software : Tftpd32 Software Version : v4.00 Vendor: http://tftpd32.jounin.net/ Vulnerability Published : 2012-05-26 Vulnerability Update Time : Status : Impact : MediumCVSS2 Base : 5.0, AV:N/AC:L/Au:N/C:N/I:N/A:P Bug Description : Tftpd32 ...

Tftpd32 DNS Server 4.00 Denial Of Service

Exploit for windows platform in category dos / poc Title: Tftpd32 DNS Server Denial Of Service Vulnerability Software : Tftpd32 Software Version : v4.00 Vendor: http://tftpd32.jounin.net/ Vulnerability Published : 2012-05-26 Vulnerability Update Time : Status : Impact : MediumCVSS2 Base : 5.0,...