163 matches found
EUVD-2026-63661
Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.readheaders/1 validates pseudo-header placement and...
CVE-2026-63379
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttpreadtrailer and merges them into request headers. The fix introduces evhttpparseheadersimpl and a temporary trailer header list. An unauthenticated remote...
CVE-2026-63379 Libevent: HTTP Header smuggling
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttpreadtrailer and merges them into request headers. The fix introduces evhttpparseheadersimpl and a temporary trailer header list. An unauthenticated remote...
PT-2026-79147
Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.read headers/1 validates pseudo-header placement and...
CVE-2026-43971
Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cowlink:link/1. cowlink:dolink/1 in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized Link: header valu...
poc-h2-duplicate-host
PoC: h2 Duplicate Host Header Request Smuggling Prim...
DEBIAN-CVE-2026-71554
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...
CVE-2026-71554
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...
CVE-2026-15157 undici vulnerable to CRLF Injection via blob-like body 'type' property
undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like...
CVE-2026-15157 undici vulnerable to CRLF Injection via blob-like body 'type' property
undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like...
CVE-2026-15157
undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like...
EUVD-2026-35096
Req vulnerable to multipart form-data header injection via unescaped name/filename/contenttype...
CVE-2026-49332
The CVE-2026-49332 entry concerns openshift/oauth-proxy. Affected component: the proxy handling of authenticated identity headers. Root cause: the proxy uses dash-variant headers (e.g., X-Forwarded-User) but does not strip underscore-variant headers (X_Forwarded_User). Because WSGI and PHP framew...
CVE-2026-49332 Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams
A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys X-Forwarded-User but does not strip underscore-variant keys XForwardedUser from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing a...
CVE-2026-49332 Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams
A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys X-Forwarded-User but does not strip underscore-variant keys XForwardedUser from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing a...
EUVD-2026-49767
A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys X-Forwarded-User but does not strip underscore-variant keys XForwardedUser from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing a...
form-data: form-data: Form field override via CRLF injection
A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return CR, line feed LF, or double-quote " characters into the field argument of FormDataappend or the filename option. This allows th...
EUVD-2025-210441
OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxy...
PT-2026-56470
OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxy...
CVE-2026-53537
Python-Multipart: Prior to 0.0.30, parse_options_header could decode RFC 2231/5987 extended parameters (filename*=, name*=, etc.) via email.message, leading to the filename/field name being surfaced in ways that RFC 7578 forbids. This allowed parameter smuggling where an attacker could bypass ups...