CVE-2026-121946

zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such a...

CVE-2026-100724

A flaw was found in http4k. When reverse proxy routing is configured with multiple virtual hosts, incoming HTTP Host headers are evaluated using loose substring matching instead of exact matching. A remote attacker can exploit this vulnerability by submitting a crafted Host header that contains t...

CVE-2026-85249

A flaw was found in Apache Camel's Tika component. When processing documents, the component maps extracted metadata keys directly to internal message headers without filtering. A remote attacker can exploit this vulnerability by submitting a crafted document with manipulated metadata, injecting...

CVE-2026-121946 zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders

zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such a...

EUVD-2026-116903

zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such a...

CVE-2026-121946 zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders

zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such a...

CVE-2026-121946

The zbateson mail-mime-parser library is vulnerable to a CRLF header injection vulnerability in versions before 3.0.9 and 4.x before 4.0.6 . The root cause is that message-building helpers fail to strip CR and LF characters from input. An attacker providing crafted values for MIME type , charset ...

CVE-2026-114456

Multiple Snowflake client drivers implementing the authenticator=externalbrowser single sign-on flow could have allowed an attacker to interfere with a user's login attempt through weaknesses in the local loopback callback listener used to receive the identity provider's response. The listener...

CVE-2026-120639

CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipartstart and dopush. With autoEscape off, header decodes HTML entities in extra header values after its newline check, so an encoded CR or LF reaches t...

CVE-2026-120633

CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, selfurl, virtualhost and virtualport. These take the host name and port from the X-Forwarded-Host request header when present, and otherwise from Host, without validating either. The URLs from url and selfurl are t...

net/http: golang: golang: Denial of Service via crafted HTTP Range headers

A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service DoS by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU...

net/http: golang: golang: Denial of Service via crafted HTTP Range headers

A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service DoS by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU...

CVE-2026-11753

A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is reflected into the HTTP Location header after successful authentication, allowing an unvalidated redirect to an attacker-controlled URL...

CVE-2026-11753

A vulnerability exists in armeria-saml versions prior to 1.41.1 where an attacker-controlled RelayState is reflected into the HTTP Location header following successful authentication. This flaw allows for an unvalidated redirect to an attacker-controlled URL. No specific exploit information or re...

EUVD-2026-116709

A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is reflected into the HTTP Location header after successful authentication, allowing an unvalidated redirect to an attacker-controlled URL...

CVE-2026-11753

A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is reflected into the HTTP Location header after successful authentication, allowing an unvalidated redirect to an attacker-controlled URL...

CVE-2026-11753

A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is reflected into the HTTP Location header after successful authentication, allowing an unvalidated redirect to an attacker-controlled URL...

CVE-2026-120435

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte...

CVE-2026-121617

A security flaw has been discovered in Linksys E5600 1.1.0.26. Affected by this issue is the function initmultipart of the file /cgi-bin/uploadfw.cgi of the component Header Parser. The manipulation results in out-of-bounds write. The attack may be launched remotely. The exploit has been released...

CVE-2026-121617

A security flaw exists in the Linksys E5600 (version 1.1.0.26 ) within the Header Parser component. Specifically, the init_multipart function in the /cgi-bin/upload_fw.cgi file is susceptible to an out-of-bounds write via manipulation. This vulnerability can be exploited remotely to potentially i...