Citrix NetScaler ADC and Gateway 14.1 HTTP Request Smuggling

Citrix NetScaler ADC and Gateway versions before vendor-fixed builds contain an HTTP request smuggling vulnerability. The supplied offline Python checker assesses operator-reported build and configuration evidence without accessing appliances...

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability that could allow HTTP request smuggling (CVE-2026-2332).

Summary IBM Storage Protect Server uses the Eclipse Jetty HTTP library in certain components. A vulnerability in Jetty's HTTP/1.1 chunked transfer encoding parser could allow HTTP request smuggling through specially crafted chunk extensions. Due to improper handling of malformed quoted strings...

Citrix NetScaler ADC and Gateway HTTP Request Smuggling

Citrix NetScaler ADC and Gateway versions before the vendor-reported fixed builds contain an HTTP request smuggling vulnerability when HTTP configuration is enabled...

Exploit for HTTP Request Smuggling in Citrix Netscaler_Application_Delivery_Controller

netscaler-cve-2026-88773-check Standa...

CVE-2026-115877

A flaw was found in Twisted. The HTTP server component improperly accepts bare carriage return or line feed characters within header values instead of enforcing strict line endings. A remote attacker can exploit this framing disagreement against an upstream proxy to conduct HTTP request smuggling...

Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

Summary An incomplete header-value validation CWE-444 in the Twisted HTTP server lets a bare carriage return or line feed in a header value hide a following header from the parser. twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in a header value but not a bare CR or LF, even thoug...

GHSA-Q7QQ-6MHP-9RC4 Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

Summary An incomplete header-value validation CWE-444 in the Twisted HTTP server lets a bare carriage return or line feed in a header value hide a following header from the parser. twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in a header value but not a bare CR or LF, even thoug...

HTTP Request Smuggling

Overview Twisted is an event-based network programming and multi-protocol integration framework. Affected versions of this package are vulnerable to HTTP Request Smuggling via the headerReceived function in src/twisted/web/http.py, which fails to reject bare CR \r and LF \n characters in HTTP...

CVE-2026-115877 Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF...

CVE-2026-115877

The Twisted event-based framework (Python 3.6+) is vulnerable to HTTP Request Smuggling prior to version 26.10.0rc1 . The root cause is located in twisted.web.http.HTTPChannel.headerReceived, which rejects NUL bytes but incorrectly accepts bare carriage returns (CR) or line feeds (LF) in header v...

CVE-2026-115877 Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF...

Security Bulletin:Vulnerability in jetty-http-12.1.10.jar may affect IBM Infosphere Change Data Capture (CVE-2026-19203)

Summary A security vulnerability has been identified in jetty-http-12.1.10.jar, Jetty module for handling HTTP protocol logic, including requests, responses, and connection management. jetty-http is used by IBM Infosphere Change Data Capture. IBM has addressed this vulnerability. Refer to the...

[SECURITY] [DSA 6580-1] erlang security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6580-1 [email protected] https://www.debian.org/security/ Aron Xu October 23, 2026 https://www.debian.org/security/faq -...

CLEANSTART-2026-LC56406 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33)

Security vulnerability affects the sonarqube package. Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' CWE-444 in Elasticsearch can lead to information disclosure via HTTP Request Smuggling CAPEC-33...

CVE-2026-115382

A flaw was found in Wasmtime. A guest WebAssembly application can trigger a Denial of Service DoS by specifying a zero timeout value in an HTTP request option. Because the runtime fails to validate this configuration before passing it to an underlying system library, an internal panic occurs that...

ROS-20261023-73-0252

The vulnerability in Tomcat10 is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to send hidden HTTP requests remotely a type of HTTP request smuggling attack...

ROS-20261023-73-0251

The vulnerability in Tomcat is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a remote attacker to send hidden HTTP requests a type of HTTP request smuggling attack...

ROS-20261023-73-0253

The vulnerability in Tomcat11 is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to send hidden HTTP requests remotely a type of HTTP request smuggling attack...

Cisco Unified Communications Manager (CUCM) < 15SU5 Improper Access Control (cisco-sa-cucm-access-PW9e8Jt2)

According to its self-reported version, Cisco Unified Communications Manager is affected by an improper access control vulnerability. - A vulnerability in Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow...

PT-2026-122233

Name of the Vulnerable Software and Affected Versions MLflow versions 3.12.0rc0 through 3.16.x Description An unauthenticated attacker can force the tracking server to make an outbound HTTP request to an arbitrary host, including internal services or cloud-metadata endpoints, with...