dotnet: ASP.NET Core Tampering Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

dotnet: ASP.NET Core Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network...

CLEANSTART-2026-IO26222 Inconsistent interpretation of http requests ('http request/response smuggling') in ASP

Security vulnerability affects the azure-functions-host package. Inconsistent interpretation of http requests 'http request/response smuggling' in ASP...

CLEANSTART-2026-YW87964 Inconsistent interpretation of http requests ('http request/response smuggling') in ASP

Security vulnerability affects the azure-functions-host package. Inconsistent interpretation of http requests 'http request/response smuggling' in ASP...

Planet Technology Planet WGS-804HPT Stack-Based Buffer Overflow (CVE-2024-48871)

PLANET WGS-804HPT is vulnerable to a stack-based buffer overflow. An unauthenticated attacker could send a malicious HTTP request that the webserver fails to properly check input size before copying data to the stack, potentially allowing remote code execution. This plugin only works with...

AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.2:CLSA-2026:1793099189)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793099189 advisory. - Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names e.g., Content-Length and...

Planet Technology Planet WGS-804HPT Improper Neutralization of Special Elements Used in an OS Command (CVE-2024-52320)

PLANET WGS-804HPT is vulnerable to a command injection. An unauthenticated attacker could send commands through a malicious HTTP request which could result in remote code execution. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Planet Technology Planet WGS-804HPT Integer Underflow (CVE-2024-52558)

PLANET WGS-804HPT is vulnerable to an integer underflow. An unauthenticated attacker could send a malformed HTTP request, which could allow the attacker to crash the program. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

ROS-20261027-73-0057

The vulnerability in Tomcat is related to flaws in handling HTTP requests. Exploitation of this vulnerability allows a remote attacker to send hidden HTTP requests an HTTP request smuggling attack...

ROS-20261027-73-0058

The vulnerability in Tomcat 10 is related to flaws in handling HTTP requests. Exploitation of this vulnerability allows a remote attacker to send hidden HTTP requests an HTTP request smuggling attack...

ROS-20261027-73-0059

The vulnerability in Tomcat 11 is related to flaws in handling HTTP requests. Exploitation of this vulnerability allows a remote attacker to send hidden HTTP requests an HTTP request smuggling attack...

body-parser: body-parser: Denial of Service via unhandled decompression stream error

A flaw was found in body-parser. A remote, unauthenticated attacker can cause a Denial of Service DoS by sending a specially crafted HTTP request with compressed content containing unexpected trailing data. Because the application fails to handle decompression stream errors after processing the...

CVE-2026-114216

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunke...

CVE-2026-112880

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in hackneyhttpconnect in benoitc hackney allows HTTP Request Splitting via the value a proxyauthfun callback returns. After a 407 response from an HTTP CONNECT proxy,...

CVE-2026-114216

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunke...

UBUNTU-CVE-2026-114216

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunke...

CVE-2026-112880 CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in hackneyhttpconnect in benoitc hackney allows HTTP Request Splitting via the value a proxyauthfun callback returns. After a 407 response from an HTTP CONNECT proxy,...

CVE-2026-112880

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in hackneyhttpconnect in benoitc hackney allows HTTP Request Splitting via the value a proxyauthfun callback returns. After a 407 response from an HTTP CONNECT proxy,...

CVE-2026-112880 CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in hackneyhttpconnect in benoitc hackney allows HTTP Request Splitting via the value a proxyauthfun callback returns. After a 407 response from an HTTP CONNECT proxy,...

EUVD-2026-109833

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in hackneyhttpconnect in benoitc hackney allows HTTP Request Splitting via the value a proxyauthfun callback returns. After a 407 response from an HTTP CONNECT proxy,...