PT-2026-108311

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The HTTP/2 implementation is lax regarding malformed framing-related headers. When acting as a reverse proxy, the system may forward responses containing these...

GHSA-P3FW-7699-7926 Docling: Configured HTTP headers sent to every remote image host named by a document

Summary HTMLBackendOptions.headers is documented for passing authentication headers API keys, bearer tokens when fetching remote images. docling sends these headers on every remote image request, to whichever host the document names. An untrusted document that references an attacker-controlled...

USN-8900-1: Go Networking vulnerabilities

It was discovered that Go Networking did not properly handle server errors after sending a GOAWAY frame during HTTP/2 connection shutdown, which could cause the connection to hang. A remote attacker could possibly use this issue to cause a denial of service. CVE-2022-27664 It was discovered that ...

Security Bulletin:urllib3: Cross-Origin Redirects Vulnerability in 1.23 to 2.7.0 Fixed in 2.7.0

Summary urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connectionfromurl.urlopen..., assertsamehost=False still forward these sensitive headers. This vulnerability is fixed in 2.7.0. Vulnerability...

afterimage

Afterimage: प्रोटोकॉल सीमा अध्ययन पहले CVE Replay के रूप में प्रकाशित। रिपॉज़िटरी का नाम और प्रस्तुति बदल गई; pinned रिलीज़, मूल रिपोर्टर एट्रिब्यूशन, fixture पथ, और रिकॉर्ड किए गए परिणाम अपनी मूल पहचान बनाए रखते हैं। स्वतंत्र ऑफ़लाइन अध्ययन सटीक रिलीज़ और सीमित fixtures का उपयोग करके प्रकाशित...

IAT-Hook

हुकिंग - IAT हुकिंग हुकिंग एक तकनीक है जो उपयोगकर्ता को किसी प्रोग्राम के निष्पादन प्रवाह को पुनर्निर्देशित करने में सक्षम बनाती है। अधिकांश समय हम फ़ंक्शन हुकिंग का उपयोग करते हैं। हम या तो किसी फ़ंक्शन को प्रतिस्थापित करते हैं या उसे अपने स्वयं के फ़ंक्शन पर पुनर्निर्देशित करते हैं, यह बहुत...

CVE-2014-6271

CVE-2014-6271 Shellshock - Exploit em Python Uma implementação Python limpa, eficiente e interativa projetada para testar a vulnerabilidade Shellshock CVE-2014-6271 através da injeção de variáveis de ambiente em HTTP. 📝 Descrição Shellshock CVE-2014-6271 é uma vulnerabilidade de segurança crítica...

Apache-Authentication-Flaw-Research-CVE-2024-38476-

🛡️ Pesquisa sobre Falha de Autenticação no Apache CVE-2024-38476 Preparado por: Abanoub Ehab 🛡️ Clube de Estudantes de Telecomunicações da Huawei - AOU Um artigo de pesquisa técnica abrangente sobre a vulnerabilidade de ambiguidade semântica no Apache HTTP Server e seu impacto no tratamento de...

USN-8893-1: Libwebsockets vulnerabilities

It was discovered that libwebsockets did not properly validate user-supplied data when parsing HTTP/2 HPACK path headers, which could result in a write past the end of an allocated buffer. An attacker could possibly use this issue to execute arbitrary code. CVE-2026-19773 It was discovered that...

puma_header_normalization-CVE-2024-45614

Puma Header normalization CVE-2024-45614 Verificação aviso: https://github.com/puma/puma/security/advisories/GHSA-9hf4-67fc-4vf4 commit de correção: https://github.com/puma/puma/commit/cac3fd18cf29ed43719ff5d52d9cfec215f0a043 Resultados Resultado da execução de request.rb duplicate Alvo| Resultad...

CVE-2025-31650

Apache Tomcat 10.1.39 - Negação de Serviço DoS Esta ferramenta realiza uma inundação de requisições HTTP/2 assíncronas e de alto volume usando cabeçalhos priority malformados para testar a estabilidade de servidores Apache Tomcat que executam as versões 10.1.10 a 10.1.39. ⚠️ Isto é estritamente...

CVE-2026-96594

A flaw was found in Gitea. The repository media application programming interface API endpoint does not return appropriate content-type and disposition security headers when serving small files directly from a repository. An authenticated attacker with repository push access can commit a maliciou...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : libsoup vulnerabilities (USN-8890-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8890-1 advisory. It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could...

CVE-2026-96594

The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...

cve-2016-5699-jinzheng-sha

cve-2016-5699-रिपोर्ट पठन पाठ्यक्रम रिपोर्ट यह रेपो एक उदाहरण को संदर्भित करता है। simple-client.py एक Python स्क्रिप्ट है जो कमांड आर्गुमेंट से प्राप्त URL पर HTTP अनुरोध करती है। simple-server.py Flask का उपयोग करके एक सरल HTTP सर्वर बनाता है जो प्राप्त अनुरोधों के हेडर प्रिंट करता है। सेट अप...

AOSP-DownloadProviderHeadersDumper

AOSP-DownloadProviderHeadersDumper PoC Exploitando a Divulgação de Cabeçalhos no Provedor de Download do Android CVE-2018-9546 Aviso de Segurança https://ioactive.com/wp-content/uploads/2019/04/IOActive-Security-Advisory-Androids-Download-Provider-Request-Headers-Disclosure-CVE-2018-9546.pdf Mais...

Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields

Root Cause File: internal/auditlog/formats.go — multiple sites write attacker-influenced bytes into the Native audit-log stream without escaping \r or \n: go // Part B — request headers lines 72–80 for k, vv := range al.Transaction.Request.Headers for , v := range vv res.WriteByte'\n'...

GHSA-PRPW-WWV7-XJJR Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields

Root Cause File: internal/auditlog/formats.go — multiple sites write attacker-influenced bytes into the Native audit-log stream without escaping \r or \n: go // Part B — request headers lines 72–80 for k, vv := range al.Transaction.Request.Headers for , v := range vv res.WriteByte'\n'...

CVE-2026-23918-poc

CVE-2026-23918 — Apache modhttp2 Double Free Afetado: Apache HTTP Server 2.4.66 com modhttp2 + Event MPM Corrigido em: Apache 2.4.67 modh2 v2.0.37 CVSS 3.1: 8.8 ALTA — Execução Remota de Código não autenticada possível CWE: CWE-415 Double Free Qual é a vulnerabilidade modhttp2 no Apache 2.4.66 te...

dovecot: Dovecot: Denial of service via crafted email headers

A flaw was found in dovecot. A remote attacker can craft a malicious email with an excessive number of email addresses or MIME parameters in its headers. When a user attempts to read this message over IMAP, the parsing process consumes an inordinate amount of memory, leading to the termination of...