Http11Probe

Http11Probe Http11Probe è un test di conformità e sicurezza per server HTTP/1.1. Invia richieste malformate, ambigue e sovradimensionate a un server tramite socket TCP grezzi e verifica come risponde rispetto a quanto effettivamente richiesto dalle RFC 9110 e RFC 9112. Questi sono i casi scomodi...

CVE-2026-47859

CVE-2026-47859 affects Spring Integration 's RFC6587SyslogDeserializer , the component used by the syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames. The root cause is that the deserializer trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array o...

CVE-2022-24903-Heap-based-buffer-overflow-Hand-On-Lab

مختبر عملي لثغرة CVE-2022-24903 المؤلف: Andrew Beshay Mousa مختبر عملي تطبيقي يوضح ثغرة تجاوز سعة المخزن المؤقت في الكومة في rsyslog. بيئة مختبرية عملية لإعادة إنتاج وفهم ثغرة تجاوز سعة المخزن المؤقت في الكومة في rsyslog CVE-2022-24903 عبر تأطير عدّاد الأوكتيت octet-counted framing في استقبال...

mongobleed

Laboratório de Vazamento de Compressão do MongoDB Educacional, Seguro Referência CVE : CVE-2025-14847 Este repositório é um laboratório educacional que demonstra o conceito por trás de uma classe de problemas frequentemente descritos como "compressão de enquadramento / divulgação de memória por...

flounder

configs/ - optionale Kontextprofile Diese JSON-Dateien sind optionale, antwortfreie Kontextprofile. Sie sind keine Flounder-Produktmodi und werden standardmäßig nicht geladen. Sie existieren für Fälle, in denen ein Operator dem Modell bewusst einen vertrauten Rahmen für eine Zielklasse geben...

CVE-2026-66752-HTTP-Request-Smuggling-via-Unparsed-Transfer-Encoding-Values-tiny_http-

Sicherheitshinweis: HTTP-Request-Smuggling durch nicht geparste Transfer-Encoding-Werte tinyhttp Zugewiesene CVE-ID: CVE-2026-66752 Zusammenfassung tinyhttp prüft lediglich, ob ein Transfer-Encoding-Header vorhanden ist. Der Wert selbst wird nie betrachtet. Jeder Wert – einschließlich Kodierungen...

heartbleed-lab

Laboratorio Heartbleed Laboratorio educativo per lo studio della vulnerabilità Heartbleed CVE-2014-0160 utilizzando un ambiente reale OpenSSL vulnerabile all'interno di Docker. Questo progetto riproduce un server TLS vulnerabile usando OpenSSL 1.0.1f e implementa un client TLS heartbeat raw...

CVE-2026-63382

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

CVE-2026-63382

CVE-2026-63382 is a critical (CVSS 4.0: 9.2) HTTP request smuggling vulnerability in Libevent 's evhttp parser (http.c). Three combined bugs—improper handling of duplicate Transfer-Encoding headers, missing validation for comma-separated values ending in chunked, and acceptance of bare LF chunk t...

CVE-2026-63382 libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

EUVD-2026-63505

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

CVE-2026-63382 libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

CVE-2026-63382 libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

cve-2026-47859 - MEDIUM - Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS

cve-2026-47859 - MEDIUM - Unbounded memory allocation in RFC6587SyslogDeserializer octet-counted framing — remote DoS...

CVE-2026-68552 Coturn: uint16_t truncation overflow in STUN message length causes TCP stream framing bypass

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an unauthenticated remote client can send a STUN message over TCP or TLS with a body-length field from 65520 through 65532, causing the uint16t len variable in stungetmessagelenstr in src/client/nsturnmsg.c to...

CVE-2026-68552 Coturn: uint16_t truncation overflow in STUN message length causes TCP stream framing bypass

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an unauthenticated remote client can send a STUN message over TCP or TLS with a body-length field from 65520 through 65532, causing the uint16t len variable in stungetmessagelenstr in src/client/nsturnmsg.c to...

BIT-NODE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-74499

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidiakaioutput sndusbmidiakaioutput computes its fill-loop bound bufend = ep-maxtransfer - MAXAKAISYSEXLEN - 1; as a signed int, so a small device-advertised bulk-OUT maxtransfer makes bufe...

Unchecked Input for Loop Condition

Overview Affected versions of this package are vulnerable to Unchecked Input for Loop Condition via CPU exhaustion through the XML framing logic in codec-xml/src/main/java/io/netty/handler/codec/xml/XmlFrameDecoder.java. An attacker can monopolize the server's EventLoop thread by sending a trickl...

PT-2026-76580

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp find header can select only the fir...