14560 matches found
UBUNTU-CVE-2026-93573
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass Transfer-Encoding header validation by splitting the Transfer-Encoding field across multiple headers, with the last field containing a non-final transfer coding like gzip or deflate. This bypass ca...
CVE-2026-93573
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass Transfer-Encoding header validation by splitting the Transfer-Encoding field across multiple headers, with the last field containing a non-final transfer coding like gzip or deflate. This bypass ca...
EUVD-2026-82979
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass Transfer-Encoding header validation by splitting the Transfer-Encoding field across multiple headers, with the last field containing a non-final transfer coding like gzip or deflate. This bypass ca...
CVE-2026-93573 Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass Transfer-Encoding header validation by splitting the Transfer-Encoding field across multiple headers, with the last field containing a non-final transfer coding like gzip or deflate. This bypass ca...
CVE-2026-93573
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass Transfer-Encoding header validation by splitting the Transfer-Encoding field across multiple headers, with the last field containing a non-final transfer coding like gzip or deflate. This bypass ca...
CVE-2026-93573
CVE-2026-93573 is a flaw in Netty's HTTP/1.1 decoder (the netty-codec-http component) that allows a remote, unauthenticated attacker to bypass Transfer-Encoding header validation by splitting the field across multiple headers, with the last field containing a non-final transfer coding such as gzi...
CVE-2026-93573 Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass Transfer-Encoding header validation by splitting the Transfer-Encoding field across multiple headers, with the last field containing a non-final transfer coding like gzip or deflate. This bypass ca...
CVE-2026-93573
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass Transfer-Encoding header validation by splitting the Transfer-Encoding field across multiple headers, with the last field containing a non-final transfer coding like gzip or deflate. This bypass ca...
CVE-2026-85511
A parameter injection flaw was identified in Red Hat EAP's Elytron security subsystem. Specifically, an EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection allows parameter substitution due to missing URL encoding . The vulnerability is rated MEDIUM...
CVE-2026-85511 Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2
A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...
EUVD-2026-82946
A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...
CVE-2026-85511 Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2
A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...
CVE-2026-85511
A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...
CVE-2026-93562
A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls ...
tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve
A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...
CVE-2026-13684
An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks...
CVE-2026-13635
An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information...
CVE-2026-13635
An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information...
EUVD-2026-82775
An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information...
CVE-2026-13635
An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information...