CVE-2026-72813 actix-files before 0.6.10 Denial of Service via empty Range header

actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header...

CVE-2025-71405

The CVE-2025-71405 entry concerns the chi library prior to v5.2.2. The vulnerability lies in the RedirectSlashes middleware, which uses the Host header to build redirect URLs. An attacker can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing and credential theft. ...

CVE-2025-71405

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...

EUVD-2025-210728

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...

CVE-2025-71405 go-chi chi before v5.2.2 Open Redirect via RedirectSlashes

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...

CVE-2025-71405

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...

CVE-2025-71405 go-chi chi before v5.2.2 Open Redirect via RedirectSlashes

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...

Improper Validation Of User-Controlled Retry Header Value

Spring Kafka is vulnerable to improper validation of user-controlled retry header value. The vulnerability is due to insufficient validation of the retrytopic-attempts header, which allows an attacker to craft an out-of-range retry attempt count and cause the retry topic router to incorrectly...

CVE-2025-71405: URL Redirection to Untrusted Site

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...

CVE-2026-72813: Uncaught Exception

actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header...

PT-2026-105551

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vrw8-fxc6-2r93. This link is maintained to preserve external references. Original Description chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that use...

CVE-2026-72816: Authentication Bypass by Spoofing

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...

PT-2026-72036

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific...

HTTP-Daemon: Improper header handling

Background HTTP-Daemon provides a base class for simple HTTP servers. Description Inconsistent Interpretation of HTTP Requests. Impact The bug could potentially be exploited to gain privileged access to APIs or poison intermediate caches. Workaround There is no known workaround at this time...

CVE-2026-19879: Incorrect Conversion between Numeric Types

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific...

GLSA-202608-10 : HTTP-Daemon: Improper header handling

The remote host is affected by the vulnerability described in GLSA-202608-10 HTTP-Daemon: Improper header handling Inconsistent Interpretation of HTTP Requests. Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory. Note that Nessus has not tested...

Linux Distros Unpatched Vulnerability : CVE-2026-19879

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString method performs a silent narrowing cast from 16-bit...

Security Updates for Azure CycleCloud < 8.9.1

The Azure CycleCloud product is missing a security update. It is, therefore, affected by the following vulnerabilities: - Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. CVE-2026-57969 - An improper input...

CVE-2026-17216

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an integer error when processing DRDA large-object headers...

USN-8638-1: Axios vulnerabilities

Ameer Assadi discovered that Axios did not properly handle certain hostnames when applying NOPROXY rules. An attacker could possibly use this issue to bypass proxy restrictions and access internal services, resulting in server-side request forgery. CVE-2025-62718 It was discovered that Axios did...