186 matches found
UBUNTU-CVE-2025-64702
quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section many unique header...
EUVD-2025-201455
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can inject headers named REMOTEADDR, REMOTEPORT,...
EUVD-2025-199588
Security Point Windows of MaLion and MaLionCloud contains a stack-based buffer overflow vulnerability in processing HTTP headers. Receiving a specially crafted request from a remote unauthenticated attacker could lead to arbitrary code execution with SYSTEM privilege...
PT-2025-48024
Security Point Windows of MaLion and MaLionCloud contains a stack-based buffer overflow vulnerability in processing HTTP headers. Receiving a specially crafted request from a remote unauthenticated attacker could lead to arbitrary code execution with SYSTEM privilege...
Django: ASGIRequest header concatenation quadratic CPU DoS on Django via repeated headers leads to worker exhaustion
ASGIRequest header concatenation quadratic CPU DoS Reporter: Jiyong Yang / BAEKSEOK University Target: Django current main, affects all versions with ASGI support Type: Denial of Service CPU exhaustion Summary django.core.handlers.asgi.ASGIRequest builds the META dictionary by iterating over the...
Linux Distros Unpatched Vulnerability : CVE-2025-52194
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier versions when processing malformed IRCAM audio files. The vulnerabili...
The vulnerability of the Squid proxy server, related to buffer overflows in the dynamic memory when processing URN headers, allows attackers to execute arbitrary code.
The vulnerability of the Squid proxy server is related to the overflow of buffers in the dynamic memory during the processing of URN headers. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending specially crafted HTTP requests...
koa 安全漏洞
koa is a Koa.js open source expressive middleware using node.js. A security vulnerability exists in koa 3.0.0 and earlier versions, which stems from a misbehavior of the parameter Referrer in the HTTP header processing component, which could lead to an open redirect...
The vulnerability of the websReadEvent() function in Intelbras RX 1500 router microprogramming software allows a intruder to execute arbitrary code or cause a service failure.
The vulnerability of the websReadEvent function in Intelbras RX 1500 router microprogramming software is related to integer overflow during the processing of the http header field. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause a service failure by sendi...
diyhi bbs 安全漏洞
diyhi bbs patrol cloud light forum system is a forum system for diyhi individual developers. A security vulnerability exists in diyhi bbs version 6.8 and earlier, which stems from improper manipulation of the Host parameter in the getUrl function of the HTTP header processing component, which cou...
Allocation of Resources Without Limits or Throttling
Overview commons-fileupload:commons-fileupload is a component that provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or...
The vulnerability of the preview function of the DevTools set of web development tools for Mozilla Firefox and the Thunderbird email client allows a hacker to bypass the Content Security Policy (CSP) protection mechanism.
The vulnerability of the pre-viewing function of the DevTools set of web development tools for Mozilla Firefox and the Thunderbird email client is related to a lack of mechanisms for encoding or blocking output data when processing headers. Exploiting this vulnerability could allow an attacker to...
The vulnerability of Nomad application orchestrators, related to incorrect processing of network packet headers, allows attackers to escalate their privileges.
The vulnerability of Nomad application orchestrators is related to incorrect processing of network packet headers. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...
The vulnerability of the PHP programming language interpreter, related to deficiencies in handling HTTP request headers, allows attackers to send hidden HTTP requests (HTTP Request Smuggling attack).
The vulnerability of the PHP programming language interpreter is related to deficiencies in the processing of HTTP request headers. Exploiting this vulnerability allows a malicious actor to send hidden HTTP requests a type of HTTP Request Smuggling attack...
OESA-2025-1451 etcd security update
%expand: Security Fixes: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large...
libsoup 代码问题漏洞
libsoup is a GNOME HTTP client/server library from the GNOME Project. A code issue vulnerability exists in libsoup that stems from a null pointer dereference in the function soupmessageheadersgetcontentdisposition, which could cause a client or server crash...
The vulnerability of the Apache Traffic Server web server, related to defects in the processing of HTTP request headers, allows attackers to send hidden HTTP requests (HTTP Request Smuggling attack).
The vulnerability of the Apache Traffic Server web server is related to deficiencies in the processing of HTTP request headers. Exploiting this vulnerability allows a malicious actor to send hidden HTTP requests remotely HTTP Request Smuggling attack...
Stream HTTP wrapper header check might omit basic auth header
...
CVE-2025-1734
In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when receiving headers from HTTP server, the headers missing a colon : are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers...
The vulnerability of the x-middleware-subrequest header processing mechanism in the Next.js web application development software platform allows attackers to circumvent existing security restrictions.
The vulnerability of the x-middleware-subrequest header processing mechanism in the Next.js web application development software platform is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions by...