RHEL 9 : gimp (RHSA-2026:98532)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:98532 advisory. The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox, including...

CVE-2026-123863: nodejs node: A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both…

A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream...

RHEL 10 : c-ares (RHSA-2026:99168)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99168 advisory. The c-ares C library defines asynchronous DNS Domain Name System requests and provides name resolving API. Security Fixes: c-ares: c-ares:...

Node.js < 24.22.3, < 26.13.1 - Reachable Assertion in HTTP/2 Session Teardown via Streams Retaining nghttp2 Header Buffers leading to Remote Process Abort

Reachable Assertion in HTTP/2 Session Teardown via Streams Retaining nghttp2 Header Buffers leading to Remote Process Abort vulnerability discovered by ? in WordPress npm Node.js versions 26.13.1...

CVE-2025-25198-PoC

CVE-2025-25198-PoC Proof-of-concept for CVE-2025-25198, a Host header poisoning issue affecting Mailcow password reset flows. The script starts a local HTTPS listener on port 443, obtains a valid CSRF token automatically, sends the password reset sequence with a poisoned Host header, and stops wh...

GHSA-X33C-W48Q-QRGC Microsoft Security Advisory CVE-2026-114149 - ASP.NET Core Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Multipart form processing can bypass the configured header-count limit and consume...

Microsoft Security Advisory CVE-2026-114149 - ASP.NET Core Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Multipart form processing can bypass the configured header-count limit and consume...

nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service DoS for the affected system...

nodejs: Node.js: Request smuggling via HTTP client header truncation

A flaw was found in Node.js. The Node.js HTTP client can cause a request desynchronization in forwarding proxies, potentially leading to request smuggling. This vulnerability arises when the HTTP client omits certain headers, such as Content-Length, from being visible to the proxy application whi...

CVE-2026-92441

Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header on regex Routes, allowing HTTP header injection and request smuggling to the upstream...

CVE-2026-125109

A flaw was found in Rack. A remote attacker can exploit this vulnerability by sending HTTP requests with specially crafted host headers containing invalid characters. Because the interface returns unvalidated host data when authority validation fails, applications relying on it to construct URLs...

CVE-2026-92441

Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header on regex Routes, allowing HTTP header injection and request smuggling to the upstream...

CVE-2026-92441

Kong Gateway Enterprise and Kong AI Gateway are vulnerable to HTTP header injection and request smuggling because they include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header when using regex Routes . The root cause is the improper neutralization of CRLF sequences ...

GHSA-R9JG-FMFX-2GV6 Action Pack: Possible cache poisoning in Action Pack content negotiation

Impact Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers, but ActionController::Renderingsetvaryheader adds Vary: Accept only when the request carries a usable Accept header and the respons...

Action Pack: Possible cache poisoning in Action Pack content negotiation

Impact Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers, but ActionController::Renderingsetvaryheader adds Vary: Accept only when the request carries a usable Accept header and the respons...

UA3F

UA3F English | 简体中文 UA3F is an HTTPS rewriting proxy that transparently rewrites HTTPS e.g., User-Agent as an HTTP, SOCKS5, TPROXY, REDIRECT, or NFQUEUE server. Supports bidirectional rewriting of HTTPS Headers and Body Supports HTTPS URL redirection: 302, 307, Header Supports HTTPS MitM traffic...

Action Pack: Possible IP spoofing in Action Dispatch RemoteIp

Impact Since Rails 8.1.0, ActionDispatch::RemoteIp derives request.remoteip from Rack::Requestforwardedfor, which under Rack 3 reads the RFC 7239 Forwarded header in preference to X-Forwarded-For. When a reverse proxy appends the client address to X-Forwarded-For but passes a client-supplied...

CVE-2026-126083

Action Pack is a framework for handling and responding to web requests. From 8.1 until 8.1.4.1, Since Rails 8.1.0, ActionDispatch::RemoteIp derives request.remoteip from Rack::Requestforwardedfor, which under Rack 3 reads the RFC 7239 Forwarded header in preference to X-Forwarded-For. When a...

GHSA-6CV4-P8M7-4R25 Forge: ReDoS in forge.http response header and cookie trimming

forge.http trims response header and Set-Cookie values with the regular expression /\s$/, which takes quadratic time on a long run of whitespace followed by another character. A server or on-path attacker can block a forge.http client for minutes with one large response header. Fixed in node-forg...

npm: Forge: ReDoS in forge.http response header and cookie trimming

npm: Forge: ReDoS in forge.http response header and cookie trimming vulnerability discovered by ? in WordPress npm node-forge versions = 0.1.2, = 1.4.2...