Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the KnativeHttpConsumer in the camel-knative HTTP consumer. An external sender can trigger a consumer-side route failure by sending a request that causes exchange processing to fail, then read the exception clas...

CVE-2026-111449

Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true disabled by default. An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that...

CVE-2026-111449

The Wheels software (versions 3.0.0 through 4.1.1 ) contains a race condition vulnerability that can disclose detailed exception information. This occurs when allowIPBasedDebugAccess=true is enabled, allowing an authorized administrator's request to modify shared application scope settings. If th...

EUVD-2026-102602

Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true disabled by default. An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that...

CVE-2026-111449

Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true disabled by default. An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that...

CVE-2026-111449

Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true disabled by default. An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that...

CVE-2026-107291

A flaw was found in Pydantic AI. When OpenTelemetry instrumentation is configured to exclude content, sensitive agent data is still exported to the telemetry backend through exception details, error status descriptions, and model request parameters. An attacker or unauthorized user with read acce...

CVE-2026-47844 Reactor Netty HTTP Server Leaks Exception Details

In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be configured with Brave Tracing. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...

EUVD-2026-66679

In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be configured with Brave Tracing. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...

CVE-2026-47844 Reactor Netty HTTP Server Leaks Exception Details

In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be configured with Brave Tracing. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...

CVE-2026-47844

Reactor Netty HTTP Server may leak exception details across unrelated requests when the server is configured with Brave Tracing . Affected versions are 1.3.0–1.3.6 , 1.1.0–1.2.18 , and 1.0.52 and earlier . The CVSS 3.1 score is 5.3 (Medium) , with low integrity impact and no confidentiality or av...

cve-2026-47844 - MEDIUM - Reactor Netty HTTP Server Leaks Exception Details

cve-2026-47844 - MEDIUM - Reactor Netty HTTP Server Leaks Exception Details...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the process handling HTTP requests when Brave Tracing is enabled. An attacker can obtain sensitive exception details from unrelated requests by sending crafted requests to the server. This is only exploitable if...

CVE-2026-42552

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::error writes the full exception message, exception code, and stack trace including absolute filesystem paths directly into the HTTP 500 response, with no debug gating. Production deployments leak...

CVE-2026-42552

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::error writes the full exception message, exception code, and stack trace including absolute filesystem paths directly into the HTTP 500 response, with no debug gating. Production deployments leak...

CVE-2026-42552

Flight PHP core prior to version 3.18.1 exposes verbose error information via the Engine::_error() handler, including the exception message, code, and full stack trace with absolute filesystem paths, in HTTP 500 responses. This leads to leakage of internal paths, secrets embedded in messages, and...

CVE-2026-42552 Flight: Sensitive information disclosure via default error handler in flightphp/core

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::error writes the full exception message, exception code, and stack trace including absolute filesystem paths directly into the HTTP 500 response, with no debug gating. Production deployments leak...

CVE-2026-42552 Flight: Sensitive information disclosure via default error handler in flightphp/core

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::error writes the full exception message, exception code, and stack trace including absolute filesystem paths directly into the HTTP 500 response, with no debug gating. Production deployments leak...

CVE-2026-42552 Flight: Sensitive information disclosure via default error handler in flightphp/core

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::error writes the full exception message, exception code, and stack trace including absolute filesystem paths directly into the HTTP 500 response, with no debug gating. Production deployments leak...

GHSA-QRCH-52M5-VV85 Flight vulnerable to sensitive information disclosure via default error handler

Summary The default error handler Engine::error writes the full exception message, exception code, and stack trace including absolute filesystem paths directly into the HTTP 500 response, with no debug gating. Production deployments leak internal paths, any secret interpolated into an exception...