436 matches found
Http11Probe
Http11Probe Http11ProbeはHTTP/1.1サーバー向けのコンプライアンスおよびセキュリティテスターです。生のTCPソケットを介して、不正な形式、あいまい、または巨大なリクエストをサーバーに送信し、RFC 9110およびRFC 9112が実際に要求する応答をチェックします。これらは、厳格なパーサーと緩和なパーサーが一致しなくなる厄介なケースです。例えば、単純なLF行末、廃止された行折り返し、CL/TEリクエストスマグリング、チャンクフレーミングのトリック、巨大なヘッダー、NULバイトなどがあります。...
http-desync-guardian
개요 HTTP/1.1은 1991년부터 2014년까지 긴 진화 과정을 거쳤습니다: HTTP/0.9 – 1991 HTTP/1.0 – 1996 HTTP/1.1 RFC 2068 – 1997 RFC 2616 - 1999 RFC 7230 - 2014 이는 서버와 클라이언트의 다양성을 의미하며, 요청 경계에 대해 서로 다른 견해를 가질 수 있어 역동기화 공격HTTP Desync의 기회를 제공합니다. 최신 RFC 권장 사항을 따르는 것이 간단해 보일 수 있습니다. 그러나 오래된 대규모 시스템의 경우, 허용할 수 없는 가용성 영향을 초래할 수...
http-desync-guardian
Overview HTTP/1.1 went through a long evolution since 1991 to 2014: HTTP/0.9 – 1991 HTTP/1.0 – 1996 HTTP/1.1 RFC 2068 – 1997 RFC 2616 - 1999 - 2014...
CLZero
CLZero Проект для фаззинга векторов атак CL.0 Request Smuggling в HTTP/1.1. О проекте Благодарность @albinowax, @defparam и @d3d, без них этого инструмента бы не было. Вдохновлён инструментом Smuggler, все атакующие гаджеты адаптированы из Smuggler и...
CVE-2026-18540
CVE-2026-18540 affects undici (Node.js HTTP client library). The retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response, presenting the original status and headers. This causes the response body to exceed the observed Content-L...
jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections
A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously...
jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections
A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously...
jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections
A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously...
jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections
A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously...
Linux Distros Unpatched Vulnerability : CVE-2026-84380
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request.prepare in src/httpx2/httpx2/models.py can add a body-derived Content-Length header...
echteeteepee
HTTP/1 Desync 脆弱性テストツール このリポジトリには、James Kettle （PortSwigger）による画期的な研究に基づき、HTTP/1 リクエストスマグリング（desync）脆弱性を検出するための防御的セキュリティツールが含まれています。 研究の帰属 この成果は、以下の技術に直接触発され、実装しています： 「HTTP/1 Must Die」 by James Kettle（PortSwigger Research） 元の研究: https://portswigger.net/research/http1-must-die 研究者: James...
EUVD-2026-66831
The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...
CVE-2026-47874
The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...
CVE-2026-47874
CVE-2026-47874 affects the Reactor Netty HTTP server. When a client sends HTTP/1.1 pipelined requests over a single connection, the server can consume excessive memory, leading to a denial of service . The affected version ranges are 1.3.0–1.3.6 , 1.1.0–1.2.18 , and 1.0.52 and earlier . The vulne...
CVE-2026-47874 Reactor Netty HTTP Server Denial of Service With Pipelined Requests
The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...
curl security, bug fix, and enhancement update
An update is available for curl. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The curl packages provide the libcurl library and the curl utility for downloadi...
cowboy: Cowboy: Denial of Service via HTTP/1.1 duplicate header names
A flaw was found in Cowboy. An unauthenticated remote attacker can exploit this vulnerability by sending multiple HTTP/1.1 header lines with the same name. This bypasses the maxheaders limit, causing the connection process memory to grow uncontrollably. This can lead to memory exhaustion and a...
Important: Red Hat Security Advisory: curl security, bug fix, and enhancement update
An update for curl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
RLSA-2026:55804 Moderate: nghttp2 security update
libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 HTTP/2 protocol in C. Security Fixes: nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 For more details about the security issues,...
