16558 matches found
CVE-2026-24001
CVE-2026-24001 concerns jsdiff, a JavaScript diff library. The description documents a denial-of-service vulnerability: if patch filenames contain line break characters (\r, \u2028, or \u2029), parsePatch can loop infinitely and exhaust memory, crashing the process. The issue affects versions pri...
SUSE CVE-2026-0865
User-controlled header names and values containing newlines can allow injecting HTTP headers...
PT-2026-5592
Impact Protected files uploaded through Umbraco Forms may be served to unauthenticated users when a CDN or caching layer is present and ImageSharp processes the request. ImageSharp sets aggressive cache headers by default, which can cause intermediary caches to store and serve files that should...
Azure Linux 3.0 Security Update: kata-containers (CVE-2022-23523)
The version of kata-containers installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-23523 advisory. - In versions prior to 0.8.1, the linux-loader crate uses the offsets and sizes provided in the ELF...
CVE-2026-0865
Missing newline filtering has been discovered in Python. User-controlled header names and values containing newlines can allow injecting HTTP headers. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria...
tornado: Tornado Quadratic DoS via Repeated Header Coalescing
A denial of service flaw has been discovered in the Tornado networking library. In Tornado, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using string concatenation when the...
libsoup: libsoup: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (First- vs Last-Value Wins)
A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the...
libsoup: libsoup: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (First- vs Last-Value Wins)
A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the...
Allocation of Resources Without Limits or Throttling
Overview swift-otel/swift-w3c-trace-context is a Micro-library exposing the W3C Trace-Context as a Swift struct Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper input validation. An attacker can cause a crash of the service b...
EUVD-2026-3520
User-controlled header names and values containing newlines can allow injecting HTTP headers...
AZL-84272 CVE-2026-0865 affecting package docbook5-style-xsl 1.79.2-11
User-controlled header names and values containing newlines can allow injecting HTTP headers...
DEBIAN-CVE-2026-0865
User-controlled header names and values containing newlines can allow injecting HTTP headers...
AZL-75032 CVE-2026-0865 affecting package python3 for versions less than 3.12.9-8
User-controlled header names and values containing newlines can allow injecting HTTP headers...
AZL-75053 CVE-2026-0865 affecting package python3 for versions less than 3.9.19-19
User-controlled header names and values containing newlines can allow injecting HTTP headers...
UBUNTU-CVE-2026-0865
User-controlled header names and values containing newlines can allow injecting HTTP headers...
CVE-2026-0865
User-controlled header names and values containing newlines can allow injecting HTTP headers...
CVE-2026-0865 wsgiref.headers.Headers allows header newline injection
User-controlled header names and values containing newlines can allow injecting HTTP headers...
PSF-2026-6
User-controlled header names and values containing newlines can allow injecting HTTP headers...
HTTP Response Splitting
Overview Affected versions of this package are vulnerable to HTTP Response Splitting via the wsgiref.headers.Headers. An attacker can manipulate HTTP responses by injecting arbitrary headers through user-controlled input containing newline characters. Remediation A fix was pushed into the master...
