3800 matches found
SUSE-SU-2026:22893-1 Security update for nghttp2
This update for nghttp2 fixes the following issue - CVE-2026-58055: HTTP request/response smuggling via upgrade request with Content-Length bsc1269489...
PT-2026-63546
Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description An attacker can force a WebSocket upgrade through the lax V07 or V08 handshaker. By sending the Sec-WebSocket-Version: 7 header and omitting the Connection:...
Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is is susceptible to multiple Netty vulnerabilities CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585
Summary Netty is used by IBM DevOps Deploy / IBM UrbanCode Deploy UCD for network communication. CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585. Vulnerability Details CVEID:CVE-2026-42580 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to...
nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests
A flaw in nghttp2's nghttpx proxy allows a remote attacker to perform HTTP request smuggling and cross-client response-queue poisoning. This occurs because the proxy ambiguously forwards HTTP/1.1 Upgrade requests that contain a Content-Length header to reusable keep-alive backend connections...
Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server, which impacts IBM Tivoli Netcool Configuration Manager
Summary IBM WebSphere Application Server is a required product for IBM Tivoli Netcool Configuration Manager version 6.4.2. Multiple vulnerabilities were addressed in IBM WebSphere Application Server. Vulnerability Details CVEID:CVE-2026-11541 DESCRIPTION: IBM WebSphere Application Server 9.0, and...
Linux Distros Unpatched Vulnerability : CVE-2026-12606
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP...
Security Bulletin: IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager is vulnerable to a denial of service
Summary A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application ManagerCVE-2026-9320, CVE-2026-8646,CVE-2026-9071 Vulnerability Details CVEID:CVE-2026-9320 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 and...
HTTP Request Smuggling io.netty:netty-codec-http Dependency in Bitbucket Data Center
This High severity io.netty:netty-codec-http Dependency vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.0, 10.0.0, 10.1.1, 10.2.0, 10.3.0 of Bitbucket Data Center and Server. This HTTP Request Smuggling vulnerability, with a CVSS Score of 7.5 and a CVSS...
HTTP Request Smuggling io.netty:netty-codec-http Dependency in Bitbucket Data Center
This High severity io.netty:netty-codec-http Dependency vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.0, 10.0.0, 10.1.1, 10.2.0, 10.3.0 of Bitbucket Data Center and Server. This HTTP Request Smuggling vulnerability, with a CVSS Score of 7.5 and a CVSS...
Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by a HTTP Request Smuggling Vulnerability in Netty (CVE-2026-33870)
Summary Netty is used by IBM DevOps Deploy / IBM UrbanCode Deploy UCD as part of the Server/Agent/Relay communication system. CVE-2026-33870. Vulnerability Details CVEID:CVE-2026-33870 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. In versions prior to...
CVE-2026-12606
Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smuggling. Grizzly 5.0.1 supports system properties that enable the behavior that fixes the vulnerability - set...
CVE-2026-12606
Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smuggling. Grizzly 5.0.1 supports system properties that enable the behavior that fixes the vulnerability - set...
CVE-2026-12606
Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP request smuggling. Grizzly 5.0.1 supports system properties that enable the behavior that fixes the vulnerability - set...
Security Bulletin: IBM Automation Decision Services for June 2026- Multiple CVEs addressed
Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Automation Decision Services. See full list below. Vulnerability Details CVEID:CVE-2026-29063 DESCRIPTION: Immutable.js provides many Persistent Immutable data...
EUVD-2026-43584
Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to ...
The vulnerability of the DefaultHttpRequest and DefaultFullHttpRequest classes in the Netty framework for developing network applications, servers, and client protocols allows a attacker to send hidden HTTP requests (HTTP Request Smuggling attack).
The vulnerability of the DefaultHttpRequest and DefaultFullHttpRequest classes in the Netty framework for developing network applications, servers, and client protocols is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to send hidden HTT...
PT-2026-57984
Name of the Vulnerable Software and Affected Versions Eclipse Grizzly versions prior to 5.0.2 Description An issue exists where the software cannot properly parse the trailer section in a malformed trailer header line. This flaw can be leveraged to perform HTTP request smuggling, a technique used...
PT-2026-57935
Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description An unauthenticated attacker can exploit an HTTP Request Smuggling issue by sending a specially crafted HTTP request. This leads to request-response desynchronization, a condition where...