Http11Probe

Http11Probe Http11Probe is a compliance and security tester for HTTP/1.1 servers. It throws malformed, ambiguous, and oversized requests at a server over raw TCP sockets and checks how it responds against what RFC 9110 and RFC 9112 actually require. These are the awkward cases like bare LF line...

flounder

configs/ - perfiles de contexto opcionales Estos archivos JSON son perfiles de contexto opcionales y sin respuestas predefinidas. No son modos del producto Flounder y no se cargan por defecto. Existen para casos en los que un operador desea deliberadamente proporcionar al modelo un marco familiar...

CVE-2026-66752-HTTP-Request-Smuggling-via-Unparsed-Transfer-Encoding-Values-tiny_http-

Aviso de Seguridad: Contrabando de peticiones HTTP mediante valores Transfer-Encoding no analizados tinyhttp ID de CVE asignado: CVE-2026-66752 Resumen tinyhttp solo comprueba si hay una cabecera Transfer-Encoding. Nunca examina su valor. Cualquier valor, incluidos codings que no son chunked y...

Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE

Summary An unauthenticated peer can make Ember's HTTP/2 read loop hold 16 MiB of a single frame in memory on a connection where Ember advertised a 16 KiB limit. The declared length is readable from the frame's first 9 bytes, but it is not compared against SETTINGSMAXFRAMESIZE until the whole...

Http4s: Ember chunk parser lenience (TE.TE request smuggling)

Summary Ember's chunk decoder parses the size token leniently: it strips leading and trailing whitespace and accepts a leading + or - sign. RFC9112 §7.1 defines chunk-size = 1HEXDIG. An intermediary that parses the chunk boundary differently or rejects it will disagree with Ember on request...

CVE-2026-69204

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rules. When ember-server is behind a keep-alive intermediary...

heartbleed-lab

Laboratorio Heartbleed Laboratorio educativo para estudiar la vulnerabilidad Heartbleed CVE-2014-0160 usando un entorno OpenSSL vulnerable real dentro de Docker. Este proyecto reproduce un servidor TLS vulnerable usando OpenSSL 1.0.1f e implementa un cliente TLS heartbeat crudo y personalizado pa...

rsyslog security update

8.2510.0-5.1 - Backport: guard regex-framing match against iCurrLine == 0 to fix crash Resolves: RHEL-212700...

mongobleed

Laboratorio de Fuga de Compresión de MongoDB Seguro, Educativo CVE de referencia : CVE-2025-14847 Este repositorio es un laboratorio educativo que demuestra el concepto detrás de una clase de problemas a menudo descritos como “compression framing / divulgación de memoria por metadatos de tamaño” ...

CVE-2022-24903-Heap-based-buffer-overflow-Hand-On-Lab

Laboratorio Práctico CVE-2022-24903 Autor: Andrew Beshay Mousa Un laboratorio práctico que demuestra la vulnerabilidad de desbordamiento de búfer en el montón de rsyslog. Un entorno de laboratorio práctico para reproducir y comprender la vulnerabilidad de desbordamiento de búfer en el montón de...

PYSEC-2026-3849 HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

Summary HTTPX2 can automatically add a Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. The resulting HTTP/1.1 request contains both framing headers, which can create an ambiguous message boundary and enable request smuggling or connection...

PT-2026-86963

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the vict...

SUSE CVE-2026-80760

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject HCICMDSYNC paramslen above 255 mgmthcicmdsync checks that the message length agrees with paramslen but puts no upper bound on it. paramslen is le16 while the parameter length in the HCI command header is a...

Linux Distros Unpatched Vulnerability : CVE-2026-18540

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the...

AZL-99939 CVE-2026-18540 affecting package nodejs 24.20.0-1

undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume...

CVE-2026-18540

undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume...

CVE-2026-18540

undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume...

libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling

A flaw was found in libevent. The evhttp parser in libevent's http.c component inconsistently handles HTTP Transfer-Encoding headers and chunked framing. This inconsistency allows an unauthenticated remote attacker to desynchronize request boundaries when libevent is used behind a proxy. Successf...

CVE-2026-63382

A flaw was found in libevent. The evhttp parser in libevent's http.c component inconsistently handles HTTP Transfer-Encoding headers and chunked framing. This inconsistency allows an unauthenticated remote attacker to desynchronize request boundaries when libevent is used behind a proxy. Successf...

CVE-2026-84380

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request.prepare in src/httpx2/httpx2/models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault processing checks each default head...