45005 matches found
EUVD-2026-80991
oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass...
GHSA-J9V4-RHGR-4M5F oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass
Summary A flaw in the CORS plugin allowed the incoming request's Vary header to be reflected into the response, letting a client influence a header that should be controlled solely by the server. Details The CORS plugin previously copied the request's Vary header directly onto the response instea...
oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass
Summary A flaw in the CORS plugin allowed the incoming request's Vary header to be reflected into the response, letting a client influence a header that should be controlled solely by the server. Details The CORS plugin previously copied the request's Vary header directly onto the response instea...
GHSA-9G45-5XWM-F3WC RMCP: Custom HTTP headers leak to cross-origin redirect targets
Summary The rmcp crate's StreamableHttpClientTransport forwards caller-supplied custom HTTP headers such as X-API-Key, X-Auth-Token, Api-Key to cross-origin redirect targets. The defaulthttpclient function builds a reqwest::Client without a redirect policy override, so the default limited10 polic...
EUVD-2026-81266
RMCP: Custom HTTP headers leak to cross-origin redirect targets...
RMCP: Custom HTTP headers leak to cross-origin redirect targets
Summary The rmcp crate's StreamableHttpClientTransport forwards caller-supplied custom HTTP headers such as X-API-Key, X-Auth-Token, Api-Key to cross-origin redirect targets. The defaulthttpclient function builds a reqwest::Client without a redirect policy override, so the default limited10 polic...
kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap
A flaw was found in the Linux kernel's mac80211 WiFi subsystem. This vulnerability allows an attacker to cause undefined behavior by injecting a specially crafted frame with an invalid radiotap header. This can lead to system instability or a denial of service DoS, potentially causing the system ...
CVE-2026-85077 Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses
Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place...
CVE-2026-85077
Sanic , an open-source Python web server/framework, is affected by an HTTP response header injection vulnerability (CVSS 3.1: 8.2 HIGH ). The root cause resides in the HTTP/1.1 response pipeline in sanic/response/types.py , which serializes header names and values without rejecting carriage-retur...
CVE-2026-85077 Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses
Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place...
CVE-2026-81829
A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...
CVE-2026-81829
CVE-2026-81829 is a same-origin SSRF vulnerability in SmallRye JWT 's AwsAlbKeyResolver , used by applications (e.g., Quarkus) to verify JWTs signed by AWS Application Load Balancers. The root cause is that the resolver constructs the key-fetch URL by directly concatenating the attacker-controlle...
EUVD-2026-81617
A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...
CVE-2026-81829 Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver
A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...
CVE-2026-81829 Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver
A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...
CVE-2026-81829
A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...
mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...
CVE-2026-25275
Transient DOS when processing authentication frames with invalid FILS information element header lengths...
golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect
A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header redirected to b.com/ will not send that header to b.com. However, the...