CVE-2026-81092 mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

CVE-2026-81092 mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

EUVD-2026-67147

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

CVE-2026-81092

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

CVE-2026-81091 mcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL

The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the mcptarget parameter and proxied to it without inspecting the...

CVE-2026-81091 mcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL

The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the mcptarget parameter and proxied to it without inspecting the...

CVE-2026-81091

CVE-2026-81091 is a Server-Side Request Forgery (SSRF) in the proxy middleware of mcp-use's inspector . The vulnerable function mountMcpProxy (in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts) read the target URL from the X-Target-URL header or __mcp_target parameter and f...

CVE-2026-55553

A flaw was found in urllib. This HTTP client for Node.js can be exploited by a remote attacker due to improper handling of cross-origin redirects. When following redirects, urllib reuses sensitive request headers, such as Authorization and Cookie, across different origins. This can lead to the...

CVE-2026-63379

A flaw was found in Libevent, an event notification library. An unauthenticated remote attacker can exploit a vulnerability where chunked HTTP Hypertext Transfer Protocol trailers are incorrectly merged into request headers. This allows the attacker to place security-sensitive fields in trailers,...

CVE-2026-16732

A flaw was found in fastify. When configured with a numeric trustProxy value, an attacker who can directly access the Fastify origin, bypassing the front-facing proxy, can spoof forwarded request fields. This vulnerability allows for host injection in generated URLs, bypasses HTTPS enforcement, a...

CVE-2026-74747

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. A local attacker can manipulate the IP Header Length ihl field within network packets. This manipulation can lead to an out-of-bounds access when the kernel attempts to revalidate embedded headers, potentially causing system...

CVE-2026-72813

A flaw was found in actix-files. This vulnerability allows a remote attacker to trigger a Denial of Service DoS by sending a GET request with an empty Range header when the application is configured to abort on panic. This can lead to the application crashing on demand. Mitigation Mitigation for...

curl: 53: HTTP/1 CONNECT chunked-407 trailers bypass CURLOPT_SUPPRESS_CONNECT_HEADERS and lose CURLH_CONNECT classification

Summary When an HTTP/1 proxy returns a chunked 407 Proxy Authentication Required during a CONNECT handshake, any trailer fields in that response are delivered to the header callback even when CURLOPTSUPPRESSCONNECTHEADERS is enabled, and are classified as CURLHTRAILER instead of CURLHCONNECT in t...

curl: CVE-2026-86409: stale SigV4 headers sent unintended

Summary Setting CURLOPTAWSSIGV4 to NULL returns CURLEOK but does not disable SigV4 authentication. The handler in lib/setopt.c clears the parameter string STRINGAWSSIGV4 but never removes the CURLAUTHAWSSIGV4 bit from data-set.httpauth. A subsequent curleasyperform on the same handle still sends ...

GHSA-9QF2-26P9-2Q2Q Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring...

Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring...

CVE-2026-47892

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring...

DEBIAN-CVE-2026-47892

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring...

CVE-2026-47880

A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, errorChannel, or jsonTypeId which are copied verbatim into the Spring Integration MessageHeaders. Spring Integration 7.1.0 Spring Integration...

CVE-2026-47892

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring...