PT-2026-64186

Name of the Vulnerable Software and Affected Versions 9router versions prior to 0.4.60 Description An issue exists involving a chain of security flaws. A hardcoded default password allows authentication on fresh installations. Additionally, the LOCAL ONLY network gate can be bypassed using a...

PT-2026-64102

Summary When Pillow loads an uncompressed image whose tile uses the raw codec and a mode in Image. MAPMODES, and the image was opened from a filename, it memory-maps the file and builds the image's row pointers directly into the mapping via PyImaging MapBuffer src/map.c. The per-row spacing strid...

PT-2026-64153

Name of the Vulnerable Software and Affected Versions swift-nio-http2 versions prior to 1.45.0 Description SwiftNIO HTTP/2 lacks validation for inbound HEADERS frames, allowing control characters such as CR, LF, NUL, and SP to reach an HTTP/1.1 backend via the HTTP/2-to-HTTP/1 codec. This can lea...

PT-2026-64146

Name of the Vulnerable Software and Affected Versions aws-smithy-http-server versions prior to 0.66.5 Description An issue in the default serve path of Amazon aws-smithy-http-server allows unauthenticated Slowloris denial of service. This occurs due to missing connection and header-read timeouts...

Next.js: Server-Side Request Forgery in Server Actions on custom servers

Impact When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host Server-Side Request Forgery. This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtai...

GHSA-89XV-2M56-2M9X Next.js: Server-Side Request Forgery in Server Actions on custom servers

Impact When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host Server-Side Request Forgery. This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtai...

EUVD-2026-43646

Eclipse Jetty: HTTP Authority/Host mismatch...

Eclipse Jetty: HTTP Authority/Host mismatch

Summary Jetty currently accepts HTTP/2 and HTTP/3 requests where the regular Host header and the pseudo-header :authority do not match. As a result, the same request can carry two different host identities through Jetty: - logic based on HttpURI / Request.getServerNamerequest uses :authority -...

GHSA-7P3P-8QV8-M2VH Eclipse Jetty: HTTP Authority/Host mismatch

Summary Jetty currently accepts HTTP/2 and HTTP/3 requests where the regular Host header and the pseudo-header :authority do not match. As a result, the same request can carry two different host identities through Jetty: - logic based on HttpURI / Request.getServerNamerequest uses :authority -...

Improper Validation of Consistency within Input

Overview org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine. Affected versions of this package are vulnerable to Improper Validation of Consistency within Input through ComplianceUtils.verifyHttpURI, HttpFields, HttpCompliance,...

GHSA-8HG6-C449-896M Dompdf: Uncontrolled resource consumption based on declared BMP dimensions

Summary dompdf accepts a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is accepted and later drives imagecreatetruecolor$width,...

CRLF Injection

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to CRLF Injection in the HttpPostRequestEncoder. An attacker can inject arbitrary MIME headers...

Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

Security Vulnerability Report: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final and all prior versions with codec-http multipart | | Component |...

GHSA-GCJF-9MGH-3P7G Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

Security Vulnerability Report: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final and all prior versions with codec-http multipart | | Component |...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection via the encodeHeaders in the STOMP frame encoder, which fails to validate or escape newline characters in header values for certain commands. An attacker can inject arbitrary headers by including newline characters in...

Netty: STOMP CONNECT Frame Header Injection in Netty

Security Vulnerability Report: STOMP CONNECT Frame Header Injection in Netty 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final and all prior versions with codec-stomp | | Component | io.netty.handler.codec.stomp.StompSubframeEncoder | |...

GHSA-3G8R-4PFX-JMFH Netty: STOMP CONNECT Frame Header Injection in Netty

Security Vulnerability Report: STOMP CONNECT Frame Header Injection in Netty 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final and all prior versions with codec-stomp | | Component | io.netty.handler.codec.stomp.StompSubframeEncoder | |...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection via the encodeV1. An attacker can inject arbitrary CRLF sequences into AFUNIX addresses by supplying specially crafted input, resulting in the creation of multiple PROXY protocol header lines. This can lead to client IP...

GHSA-C69G-56F8-XWQJ Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass

Netty's HTTP/2-to-HTTP/1.x translation layer Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter fails to deduplicate or validate Host headers when an HTTP/2 client supplies both the :authority pseudo-header and a literal host header in a single HEADERS frame. The translator maps...

Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass

Netty's HTTP/2-to-HTTP/1.x translation layer Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter fails to deduplicate or validate Host headers when an HTTP/2 client supplies both the :authority pseudo-header and a literal host header in a single HEADERS frame. The translator maps...