GHSA-RF44-J88R-HH8C Traefik: ForwardAuth identity spoofing via dot-form header alias

Summary There is a medium severity vulnerability in Traefik's handling of request headers whose name aliases another header name. Go canonicalizes header names on dashes only, so X-Auth-User, XAuthUser and X.Auth.User are three distinct headers to Traefik, while backends that derive variable name...

GHSA-W47M-JPV2-QFW5 Duplicate Advisory: Knowns Sandbox Escape: Unauthenticated Header Injection Grants AI Agent Unrestricted Access to Host Filesystem

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9h2q-r9fh-f98w. This link is maintained to preserve external references. Original Description knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode...

Duplicate Advisory: Knowns Sandbox Escape: Unauthenticated Header Injection Grants AI Agent Unrestricted Access to Host Filesystem

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9h2q-r9fh-f98w. This link is maintained to preserve external references. Original Description knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode...

DEBIAN-CVE-2026-89044

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding...

CVE-2026-89044

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding...

EUVD-2026-75633

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding...

CVE-2026-89044 Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding...

CVE-2026-89044

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final contain an HTTP request smuggling vulnerability in the Transfer-Encoding header handling within the HTTP codec. The root cause is a failure to properly validate the final transfer coding: attackers can split ...

Security Bulletin: IBM MQ Appliance is affected by an XML external entity injection vulnerability (CVE-2026-12666)

Summary IBM MQ Appliance has addressed an XML external entity injection vulnerability that could allow an authenticated attacker to obtain sensitive information or cause a denial of service when processing MQRFH2 headers. Vulnerability Details CVEID:CVE-2026-12666 DESCRIPTION: IBM MQ Classes for...

Security Bulletin: IBM MQ Appliance is affected by an improper validation vulnerability in message header offset processing (CVE-2026-11726)

Summary IBM MQ Appliance has addressed an improper validation vulnerability in message header offset processing that could allow an authenticated attacker to obtain sensitive information or cause a denial of service. Vulnerability Details CVEID:CVE-2026-11726 DESCRIPTION: IBM MQ could allow an...

Open Redirect

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Open Redirect in the GitLab pagination handling, which follows the URL given in a Link header and attaches the GitLab credentials to the next-page request without confining the follow to the original...

Open Redirect

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Open Redirect via the Link header when following pagination links from a server response. An attacker can obtain configured credentials by manipulating the Link header to redirect requests to an...

Open Redirect

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Open Redirect in the Docker registry pagination handling, which follows the URL given in an HTTP Link header while still attaching the registry credentials, without confining the follow to the original...

Open Redirect

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Open Redirect in the process of handling pagination for NuGet registries via the HTTP Link header. An attacker can obtain registry credentials by configuring a malicious or compromised registry to suppl...

SUSE CVE-2026-61908

An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H-, which could read past the end of the internal blobheaders array during download, exposing...

axios: Axios: Information disclosure of proxy credentials via redirect flows

A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final...

netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message

A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2TYPESSL TLV Type-Length-Value header. This can lead to an IndexOutOfBoundsException...

tar: Node-tar: Denial of Service via malformed tar archive header

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...

activemq-stomp: Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec

An unbounded memory allocation flaw was found in the STOMP NIO codec of Apache ActiveMQ Classic. An unauthenticated remote client can open a STOMP NIO connection and send an unterminated header, causing the broker to buffer input without limit and potentially exhaust the JVM heap, resulting in a...

netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...