CVE-2022-21907-http.sys

CVE-2022-21907 - Двойное освобождение в драйвере http.sys CVE-2022-21907 - Двойное освобождение в драйвере http.sys Краткое описание Неаутентифицированный злоумышленник может отправить HTTP-запрос с заголовком "Accept-Encoding", что вызывает двойное освобождение в неизвестном списке кодировок...

CVE-2021-31166

CVE-2021-31166 Зачем Недавно я написал эксплойт для CVE-2021-31166, он эксплуатирует CVE-2021-31166 и CVE-2021-31166. Пентестеру следует использовать https://github.com/mauricelambert/CVE-2021-31166, но командам SOC нужно знать конкретную уязвимость, чтобы правильно её устранить, именно поэтому я...

CVE-2021-31166

CVE-2021-31166 الكشف عن محاولات استغلال CVE-2021-31166 ثغرة في مكدس بروتوكول HTTP قاعدة Suricata حزمة Zeek المراجع https://corelight.blog/2021/05/27/detecting-cve-2021-31166-http-vulnerability/ https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31166...

cve-2022-21907

CVE-2022-21907 Applicazione Golang di 1vere$k CVE-2022-21907 - Double Free nel driver http.sys. Riepilogo Questa è un'applicazione Golang multithreading che consente di effettuare richieste su più target contemporaneamente. Non è molto produttiva con le richieste POST, ma fornisce quasi il 30% di...

CVE-2021-31166-Exploit

CVE-2021-31166-Exploit Exploit für die RCE-Schwachstelle im MS-HTTP-Protokollstapel CVE-2021-31166 Eine speziell präparierte HTTP-Anfrage, die auf eine verwundbare Windows-Version abzielt, führt zu einem DoS-Angriff. Der Server wird mit einem Blue Screen neu gestartet. Http.sys ist ein...

CVE-2026-63382

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

CVE-2026-63382 libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

CVE-2026-9190 HTTP request smuggling in Progress MarkLogic Server

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP...

Security Bulletin: IBM Storage Protect Server is affected by multiple vulnerability in the netty-codec-http library that could allow an attacker to exploit integer overflow conditions when processing chunked HTTP requests(CVE-2026-42581, CVE-2026-42584).

Summary IBM Storage Protect Server uses the netty-codec-http library in certain components. Netty is vulnerable to multiple vulnerability that could allow an attacker to exploit integer overflow conditions when processing chunked HTTP requests. This may lead to inconsistent request parsing and...

CVE-2026-64607

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

EUVD-2026-35098

Req vulnerable to unbounded archive/compression extraction triggered by response content-type...

CVE-2026-67181

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to...

CVE-2026-67181 Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding Header

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to...

CVE-2026-67181

Rouille versions 0.3.3 through 3.6.2 are affected by an HTTP request smuggling vulnerability via the proxy Transfer-Encoding header. The issue arises because the proxy in src/proxy.rs forwards the client’s Transfer-Encoding header to upstream backends unchanged while transmitting a body that has ...

EUVD-2026-49881

tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-Encoding header with any value, including non-chunked codings, which causes the library to unconditionally apply chunk-decoding and discard...

CVE-2026-66731 facil.io 0.7.5 - 0.7.6 HTTP/1.1 Chunked Transfer Encoding Parser Crash DoS

facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser that allows unauthenticated remote attackers to crash the server by sending a negative chunk size value. Attackers can send a single POST request with a Transfer-Encoding:...

httpd: incomplete fix for CVE-2023-38709

A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers. These issues lead to HTTP response splitting. This CVE provides a "complete" fix for CVE-2023-38709...

PYSEC-2026-1433 Gunicorn HTTP Request/Response Smuggling vulnerability

Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data...

httpd: incomplete fix for CVE-2023-38709

A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers. These issues lead to HTTP response splitting. This CVE provides a "complete" fix for CVE-2023-38709...

CVE-2026-49755

Improper Handling of Highly Compressed Data Data Amplification vulnerability in wojtekmach Req allows attacker-controlled HTTP servers to exhaust memory in a Req client via decompression-bomb response bodies. Req's default response pipeline includes Req.Steps.decodebody/1 and...