2530 matches found
Astra Linux – Vulnerability in Python 3.11
User-controlled header names and values containing newlines can allow for the injection of HTTP headers...
CVE-2026-54465
A flaw was found in websocket-driver, a WebSocket protocol handler. A remote attacker can exploit this vulnerability by sending an HTTP request or response with a never-ending list of headers to a server or client using websocket-driver. This can cause the receiving process to consume an unbounde...
CVE-2026-0516
A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host header and redirect firewall management users to arbitrary web domains...
org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or...
PT-2026-65731
Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...
CVE-2026-67183 TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling
TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...
CVE-2026-65624
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. The HTTP/1.1 handler in cowboyhttp enforces the maxheaders limit by counting the number of distinct header names in ...
EUVD-2026-49740
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. The HTTP/1.1 handler in cowboyhttp enforces the maxheaders limit by counting the number of distinct header names in ...
Vulnerabilities found in Oracle Financial Services
Oracle has identified vulnerabilities in various Financial Services modules. Oracle has also processed updates for various third-party products. The vulnerabilities include code injection through malicious schemes in Apache Avro, unauthorized access to sensitive data in various Oracle products, a...
Tornado: Quadratic DoS via Repeated Header Coalescing
Summary The HTTPHeaders.add method in Tornado accumulates values using string concatenation when the same header name is repeated. Due to Python string immutability, each concatenation copies the entire string, resulting in On² time complexity. Given Tornado's single event loop architecture, a...
EUVD-2025-203031
Tornado: Quadratic DoS via Repeated Header Coalescing...
CVE-2024-58368 SurrealDB before 1.1.0 Denial of Service via HTTP Headers
SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can send crafted HTTP requests with malformed header values to trigger an uncaught exception that crashes the server...
CVE-2026-54465
CVE-2026-54465 affects websocket-driver (Ruby) prior to version 0.8.1. A WebSocket server built on top of a TCP server via WebSocket::Driver.server() or a WebSocket client can trigger a memory exhaustion by sending an HTTP request/response with an unbounded, never-ending header list. The issue is...
CVE-2026-21762
Technical details are not publicly available in the provided documents. Monitor for updates.
PT-2026-60380
Name of the Vulnerable Software and Affected Versions websocket-driver versions prior to 0.8.1 Description When used to implement a WebSocket server on top of a TCP server via the WebSocket::Driver.server method or to complement a WebSocket client, the software is susceptible to memory exhaustion...
CVE-2025-62675
The CVE-2025-62675 entry concerns an issue described as an Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Response Splitting) in Fortinet FortiOS and FortiProxy products. Affected versions are FortiOS 7.6.0–7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6...
CVE-2026-58229
The CVE-2026-58229 issue affects the Elixir Mint HTTP client. Mint.HTTP1.decode_headers/5 and Mint.HTTP1.decode_trailer_headers/4 accumulate all parsed response headers and trailer fields into a request.headers_buffer without a cap, and decoding uses unlimited per-line/packet limits. A malicious ...
AlmaLinux 8 : nginx:1.24 (ALSA-2026:38847)
The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:38847 advisory. nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-42055 Bug Fixes and Enhancements:...
PT-2026-60780
Name of the Vulnerable Software and Affected Versions HTTP::Date versions prior to 6.08 Description An issue exists where the parse date function, which is also used by str2time, is susceptible to Regular Expression Denial of Service ReDoS. This occurs because several regex patterns use unbounded...