Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed WebSphere Application Server is affected by an HTTP request smuggling vulnerability (CVE-2026-11710)

Summary The security issue described in CVE-2026-11710 has been identified in WebSphere Application Server included as part of IBM Tivoli Composite Application Manager for Application Diagnostics Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affecte...

Exploit for Improper Access Control in Widgetfactorylimited Jce

E.L.V CVE Research & Assessment Framework E.L.V — Exploit...

SUSE CVE-2026-90678

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer...

PT-2026-92407

Name of the Vulnerable Software and Affected Versions Http4s versions prior to 0.23.35 Http4s versions prior to 1.0.0-M47 Description Ember's chunk decoder parses the chunk-size token leniently by trimming whitespace and accepting leading plus or minus signs, which deviates from the requirement f...

PT-2026-98964

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests...

PT-2026-97284

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.25 Apache Tomcat versions 10.1.0-M1 through 10.1.59 Apache Tomcat versions 9.0.47 through 9.0.121 Apache Tomcat versions 8.5.67 through 8.5.100 Description An inconsistent interpretation of HTTP...

ROS-20260915-73-0131

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

PT-2026-92423

Summary Ember's HTTP/1.1 header parser matches the Transfer-Encoding header value with a case-sensitive substring test hValue.contains"chunked". RFC 9112 §7 requires transfer-coding names to be compared case-insensitively. A request carrying Transfer-Encoding: Chunked capital C is therefore not...

CVE-2024-14029: Inconsistent Interpretation of HTTP Requests

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling...

CVE-2026-69204: Inconsistent Interpretation of HTTP Requests

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rules. When ember-server is behind a keep-alive intermediary...

PT-2026-97299

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.22 through 11.0.25 Apache Tomcat versions 10.1.55 through 10.1.59 Apache Tomcat versions 9.0.118 through 9.0.121 Description An inconsistent interpretation of HTTP/2 requests, known as HTTP Request/Response smugglin...

SUSE SLES15 Security Update : python-aiohttp (SUSE-SU-2026:4113-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4113-1 advisory. - CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated...

CVE-2023-54397: Inconsistent Interpretation of HTTP Requests

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain...

ROS-20260915-73-0162

The vulnerability of the Chromecast web browsers Google Chrome and Microsoft Edge is related to errors in HTTP request processing. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

CVE-2024-14029: Inconsistent Interpretation of HTTP Requests

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling...

CVE-2026-92238: Inconsistent Interpretation of HTTP Requests

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...

Security Bulletin: Multiple Vulnerabilities in IBM Data Product Hub

Summary Multiple vulnerabilities were addressed in IBM Data Product Hub version 5.3.1 Patch 13 Vulnerability Details CVEID:CVE-2026-14981 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are affected by a denial of...

CVE-2026-15396

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request...

CVE-2026-15634

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request...

CVE-2026-15396

CVE-2026-15396 affects IBM WebSphere Application Server (traditional 8.5 and 9.0) and IBM WebSphere Application Server Liberty (versions 17.0.0.3–26.0.0.8). The root cause is improper parsing of the HTTP transfer-encoding request header (CWE-444), enabling HTTP request smuggling . An unauthentica...