Lucene search
+L

786419 matches found

Github Security Blog
Github Security Blog
added yesterday4 views

Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Impact A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This is only an issu...

5.3AI score
Exploits0References6Affected Software1
OSV
OSV
added yesterday1 views

GHSA-4633-3J49-MH5Q Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Impact A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This is only an issu...

6.3CVSS
Exploits0References6
Patchstack
Patchstack
added yesterday4 views

NPM: Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

NPM: Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname vulnerability discovered by ? in WordPress Npm next versions = 12.0.0, 15.5.21...

5.3AI score
Exploits0References6Affected Software1
Github Security Blog
Github Security Blog
added yesterday4 views

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Impact A rewrites or redirects rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the...

5.6AI score
Exploits0References6Affected Software1
OSV
OSV
added yesterday3 views

GHSA-P9J2-GV94-2WF4 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Impact A rewrites or redirects rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the...

8.3CVSS
Exploits0References6
Github Security Blog
Github Security Blog
added yesterday2 views

Next.js: Denial of Service in the Image Optimization API using SVGs

Impact When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured not enabled by default. If those images contain malicious content, they can cause CPU exhaustion in /next/image endpoints. - If you are using...

5.3AI score
Exploits0References6Affected Software1
OSV
OSV
added yesterday3 views

GHSA-Q8WF-6R8G-63CH Next.js: Denial of Service in the Image Optimization API using SVGs

Impact When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured not enabled by default. If those images contain malicious content, they can cause CPU exhaustion in /next/image endpoints. - If you are using...

6.3CVSS
Exploits0References6
Github Security Blog
Github Security Blog
added yesterday3 views

Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests

Impact The original report: Server handling of 100-Continue requests can lead to memory leak that can be abused to cause a Denial of Service state. After investigation, turns out that every request that has a body, but reading the body may end up in reading 0 bytes, leaks a buffer. This is...

7.5CVSS5.2AI score0.00252EPSS
Exploits0References8Affected Software1
OSV
OSV
added yesterday2 views

GHSA-9299-C6M4-MJHC Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests

Impact The original report: Server handling of 100-Continue requests can lead to memory leak that can be abused to cause a Denial of Service state. After investigation, turns out that every request that has a body, but reading the body may end up in reading 0 bytes, leaks a buffer. This is...

7.5CVSS0.00252EPSS
Exploits0References8
Github Security Blog
Github Security Blog
added yesterday3 views

Eclipse Jetty: Path parameter traversal

Description as reported Summary In Jetty 12.1.8, org.eclipse.jetty.util.URIUtil.canonicalPath may leave dot-dot path segments unnormalized when a semicolon path parameter marker is followed by a slash and a dot segment. A minimal example is: /public;/../admin/secret In my local reproduction,...

5.3CVSS5.5AI score0.00198EPSS
Exploits1References10Affected Software1
OSV
OSV
added yesterday2 views

GHSA-W7X5-G22V-XQHR Eclipse Jetty: Path parameter traversal

Description as reported Summary In Jetty 12.1.8, org.eclipse.jetty.util.URIUtil.canonicalPath may leave dot-dot path segments unnormalized when a semicolon path parameter marker is followed by a slash and a dot segment. A minimal example is: /public;/../admin/secret In my local reproduction,...

5.3CVSS0.00198EPSS
Exploits1References10
Github Security Blog
Github Security Blog
added yesterday5 views

Eclipse Jetty: HTTP Authority/Host mismatch

Summary Jetty currently accepts HTTP/2 and HTTP/3 requests where the regular Host header and the pseudo-header :authority do not match. As a result, the same request can carry two different host identities through Jetty: - logic based on HttpURI / Request.getServerNamerequest uses :authority -...

5.3CVSS5.8AI score0.00196EPSS
Exploits0References13Affected Software1
OSV
OSV
added yesterday1 views

GHSA-7P3P-8QV8-M2VH Eclipse Jetty: HTTP Authority/Host mismatch

Summary Jetty currently accepts HTTP/2 and HTTP/3 requests where the regular Host header and the pseudo-header :authority do not match. As a result, the same request can carry two different host identities through Jetty: - logic based on HttpURI / Request.getServerNamerequest uses :authority -...

5.3CVSS0.00196EPSS
Exploits0References13
Github Security Blog
Github Security Blog
added yesterday4 views

Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections

Description FINDING — MEDIUM HTTP/1.1 keep-alive connections with trailers HttpConnection.trailers Cross-Request Leakage Never Reset Between Requests Location: jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/internal/ HttpConnection.java:107, 1157-1161, 1170 Detail: trailers line 1...

7.5CVSS5.3AI score0.00253EPSS
Exploits1References10Affected Software1
EUVD
EUVD
added yesterday10 views

EUVD-2026-43645

Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections...

7.5CVSS5.2AI score0.00253EPSS
Exploits1References9
OSV
OSV
added yesterday1 views

GHSA-F4V5-65JJ-PCR2 Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections

Description FINDING — MEDIUM HTTP/1.1 keep-alive connections with trailers HttpConnection.trailers Cross-Request Leakage Never Reset Between Requests Location: jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/internal/ HttpConnection.java:107, 1157-1161, 1170 Detail: trailers line 1...

6.9CVSS0.00253EPSS
Exploits1References10
OSV
OSV
added yesterday2 views

GHSA-J8QW-6JW8-R297 Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

Summary If a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document. Details Using an element inside a data-URI...

6.3CVSS
Exploits0References4
Github Security Blog
Github Security Blog
added yesterday3 views

Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

Summary If a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document. Details Using an element inside a data-URI...

5.5AI score
Exploits0References4Affected Software1
Github Security Blog
Github Security Blog
added yesterday2 views

Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

Summary Dompdf v3.1.5 is vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000 pixels. While Dompdf implements internal checks...

6.1AI score
Exploits0References5Affected Software1
OSV
OSV
added yesterday2 views

GHSA-F5GF-2CJ8-52G2 Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

Summary Dompdf v3.1.5 is vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000 pixels. While Dompdf implements internal checks...

6.3CVSS
Exploits0References5
Rows per page
Query Builder