DEBIAN-CVE-2024-58384

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests...

CVE-2024-58384

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests...

AZL-103104 CVE-2024-58384 affecting package python-tornado 6.3.3-11

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests...

CVE-2024-58384

A flaw was found in Tornado's CurlAsyncHTTPClient component. This vulnerability, known as CRLF Carriage Return Line Feed injection, occurs because the client fails to properly reject carriage return and line feed characters in HTTP request headers. A remote attacker can exploit this by injecting...

CVE-2026-59157

webhookd is a minimalist webhook server that triggers shell scripts via HTTP requests. Prior to 1.22.0 , deployments without htpasswd authentication forwarded all incoming HTTP headers into the hook script environment via HTTPParamsToShellVars in pkg/api/index.go without an allowlist. If an upstr...

CVE-2026-59157 webhookd: Unrestricted HTTP Header to Shell Variable Injection

webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd authentication forwarded all incoming HTTP headers through HTTPParamsToShellVars in pkg/api/index.go into the hook script...

CVE-2024-58384 Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests...

CVE-2024-58384

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests...

CVE-2024-58384

CVE-2024-58384 affects the Tornado Python web framework in versions before 6.4.1 . The flaw resides in the CurlAsyncHTTPClient component, which fails to reject carriage return and line feed (CRLF) characters in HTTP request headers. A remote attacker can inject CRLF sequences into header values t...

EUVD-2024-55766

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests...

CVE-2026-59230

A flaw was found in Apache Camel's camel-mail component. The MimeMultipart data format copies MIME headers from an incoming message onto the Camel message when unmarshalling with headersInline=true, without applying a HeaderFilterStrategy. An attacker who can provide a crafted MIME message may...

CVE-2026-33453

Reproductor de la vulnerabilidad de inyección de cabeceras → RCE en camel-coap CVE-2026-33453 Este proyecto demuestra una vulnerabilidad de inyección de cabeceras de mensajes Camel en el componente camel-coap de Apache Camel, registrada como CVE-2026-33453. Un atacante no autenticado que pueda...

CVE-2026-86818 fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still...

CVE-2026-47323

camel-cxf-rest / camel-cxf / camel-knative-http 头部注入复现工具 CVE-2026-47323 该项目演示了 Apache Camel 的 CXF 和 Knative HTTP 头部过滤策略中的消息头部注入 漏洞，追踪编号为 CVE-2026-47323 。CxfRsHeaderFilterStrategy camel-cxf-rest、CxfHeaderFilterStrategy camel-cxf-transport 和 KnativeHttpHeaderFilterStrategy camel-knative-http 仅过滤出站 ...

CVE-2026-40047

Reproductor de inyección de argumentos CLI / path traversal en camel-docling CVE-2026-40047 Este proyecto demuestra una vulnerabilidad de inyección de argumentos CLI y path traversal en el componente camel-docling de Apache Camel, registrada como CVE-2026-40047. DoclingProducer construye la...

CVE-2026-48205

camel-dns dns. / term Header Injection Reproducer CVE-2026-48205 Este proyecto demuestra una inyección de encabezados de mensaje en el componente camel-dns de Apache Camel, registrada como CVE-2026-48205. Los productores DNS leen sus parámetros de operación — el resolvedor a consultar, el...

CVE-2026-46588

camel-couchdb CouchDb Header Injection Reproducer CVE-2026-46588 This project demonstrates a message-header injection in Apache Camel's camel-couchdb component, tracked as CVE-2026-46588. The component reads several Exchange headers to control its behaviour — CouchDbDatabase, CouchDbSeq, CouchDbI...

CVE-2026-46592

CVE-2026-46592 — camel-cxf operationName 请求头注入（SOAP 操作重定向） 针对同一 Apache Camel 漏洞的可运行概念验证复现程序，每种运行时一个： 运行时| 目录| 技术栈| 后端 SOAP 服务 ---|---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2| 使用 CXF ServerFactoryBean 运行在独立端口 :9000 Camel Quarkus| camel-quarkus/|...

CVE-2026-48204

CVE-2026-48204 — Inyección de cabeceras gridfs. en camel-mongodb-gridfs Reproductores de prueba de concepto ejecutables para la misma vulnerabilidad de Apache Camel, uno por runtime:...

CVE-2026-46726

CVE-2026-46726 — Inyección de Cabeceras en camel-vertx-websocket SSRF + Divulgación de Secretos Reproductores de prueba de concepto ejecutables para la misma vulnerabilidad de Apache Camel, uno por runtime:...