5268 matches found
Exploit for CRLF Injection in Oracle Concurrent_Processing
See our...
DEBIAN-CVE-2025-59419
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Netty contains an SMTP command injection vulnerability due to insufficient input validation for Carriage Return \r and Line Feed \n characters in user-suppli...
UBUNTU-CVE-2025-59419
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Netty contains an SMTP command injection vulnerability due to insufficient input validation for Carriage Return \r and Line Feed \n characters in user-suppli...
CVE-2025-59419
Netty CVE-2025-59419 is a CRLF injection vulnerability in the SMTP codec. In Netty versions prior to 4.1.128.Final and 4.2.7.Final, io.netty.handler.codec.smtp.DefaultSmtpRequest concatenates parameters into SMTP commands without sanitization, enabling an attacker-controlled CRLF sequence in reci...
CVE-2025-59419 Netty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email Forgery
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Netty contains an SMTP command injection vulnerability due to insufficient input validation for Carriage Return \r and Line Feed \n characters in user-suppli...
CVE-2025-59419 Netty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email Forgery
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Netty contains an SMTP command injection vulnerability due to insufficient input validation for Carriage Return \r and Line Feed \n characters in user-suppli...
CVE-2025-53474
creationtimestamp| type| source ---|---|--- 2025-10-15 15:31:29+00:00| seen| https://vulnerability.circl.lu/bundle/834a30cc-c06c-49b3-9157-eb77f711c73f 2025-10-16 09:05:24+00:00| seen| https://circl.lu/pub/tr-96/ 2026-02-06 17:10:05+00:00| seen|...
CVE-2025-59478
creationtimestamp| type| source ---|---|--- 2025-10-15 15:31:29+00:00| seen| https://vulnerability.circl.lu/bundle/834a30cc-c06c-49b3-9157-eb77f711c73f 2025-10-16 09:05:24+00:00| seen| https://circl.lu/pub/tr-96/...
CVE-2025-61960
creationtimestamp| type| source ---|---|--- 2025-10-15 15:31:29+00:00| seen| https://vulnerability.circl.lu/bundle/834a30cc-c06c-49b3-9157-eb77f711c73f 2025-10-16 09:05:24+00:00| seen| https://circl.lu/pub/tr-96/...
CVE-2025-60016
creationtimestamp| type| source ---|---|--- 2025-10-15 15:31:29+00:00| seen| https://vulnerability.circl.lu/bundle/834a30cc-c06c-49b3-9157-eb77f711c73f 2025-10-16 09:05:24+00:00| seen| https://circl.lu/pub/tr-96/ 2025-10-17 13:38:40+00:00| seen|...
CVE-2025-61951
creationtimestamp| type| source ---|---|--- 2025-10-15 15:31:29+00:00| seen| https://vulnerability.circl.lu/bundle/834a30cc-c06c-49b3-9157-eb77f711c73f 2025-10-16 09:05:24+00:00| seen| https://circl.lu/pub/tr-96/...
CVE-2025-54479
creationtimestamp| type| source ---|---|--- 2025-10-15 15:31:29+00:00| seen| https://vulnerability.circl.lu/bundle/834a30cc-c06c-49b3-9157-eb77f711c73f 2025-10-16 09:05:24+00:00| seen| https://circl.lu/pub/tr-96/...
PT-2025-42370
Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.128.Final and 4.2.7.Final Description Netty contains an SMTP command injection vulnerability due to insufficient input validation for Carriage Return r and Line Feed characters in user-supplied parameters. The...
netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions
A flaw in Netty’s HTTP/1.1 chunked encoding parser allows newline LF characters in chunk extensions to be incorrectly treated as the end of the chunk-size line instead of requiring the proper CRLF sequence. This discrepancy can be exploited in rare cases where a reverse proxy interprets the same...
CVE-2025-61689
HTTP.jl is an HTTP client and server functionality for the Julia programming language. Prior to version 1.10.19, HTTP.jl did not validate header names/values for illegal characters, allowing CRLF-based header injection and response splitting. This enables HTTP response splitting and header...
WordPress Smash Balloon Social Post Feed plugin <= 4.3.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Smash Balloon Social Post Feed versions = 4.3.2...
CVE-2025-47340
creationtimestamp| type| source ---|---|--- 2025-10-09 04:10:53+00:00| seen| Telegram/-xl3SdcYXt8LMGvX53Jj1dAcLH8ERwojJEBXBAQCFo0MHE...
JLSEC-2025-1 CR/LF injection in URIs.jl (also affects HTTP.jl)
Description The URIs.jl and HTTP.jl packages allowed the construction of URIs containing CR/LF characters. If user input was not otherwise escaped or protected, this can lead to a CRLF injection attack. With this simple Julia code, you can inject a custom header named Foo with the value bar: juli...
