CVE-2026-112212 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an...

CVE-2026-112212

GitLab CE/EE versions 18.3 before 19.3.6 , 19.4 before 19.4.3 , and 19.5 before 19.5.1 are vulnerable to HTTP Request/Response Smuggling (CWE-444). An unauthenticated user can poison a shared cache's OAuth/OIDC discovery document because the software improperly trusts user-supplied values when co...

CVE-2017-14980.RCE

CVE-2017-14980 The exploit targets Sync Breeze Enterprise running on Windows 10 x86, build: 16299 , affecting version 10.0.28 , where an unauthenticated attacker can perform a buffer overflow via an HTTP-request body , resulting in arbitrary code execution. This exploit assumes all security...

net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses

A flaw was found in Go's net/http package. When an HTTP server sends a successful response to an HTTP/1 CONNECT request without taking raw control of the connection, it improperly continues to process incoming data as standard HTTP requests instead of establishing a tunnel. A remote attacker can...

net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses

A flaw was found in Go's net/http package. When an HTTP server sends a successful response to an HTTP/1 CONNECT request without taking raw control of the connection, it improperly continues to process incoming data as standard HTTP requests instead of establishing a tunnel. A remote attacker can...

CVE-2026-76487

A vulnerability in Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This vulnerability is due to improp...

CVE-2026-76487 Cisco Unified Communications Manager Improper Access Control Vulnerability

A vulnerability in Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This vulnerability is due to improp...

CVE-2026-76487

A vulnerability exists in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) . The flaw stems from improper input validation for specific HTTP requests, which could allow an unauthenticated, remote attacker to per...

EUVD-2026-107348

A vulnerability in Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This vulnerability is due to improp...

CVE-2026-76487 Cisco Unified Communications Manager Improper Access Control Vulnerability

A vulnerability in Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This vulnerability is due to improp...

Cisco Unified Communications Manager Improper Access Control Vulnerability

A vulnerability in Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This vulnerability is due to improp...

Two critical RCEs in PHP core

Update 10/22: Added section detailing observations of in the wild exploitation and associated IOCs. Cisco Talos is tracking the disclosure of two unauthenticated remote code execution RCE flaws in PHP core, dubbed "php2shell", triggered by a plain HTTP request and exploitable before any applicati...

net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses

A flaw was found in Go's net/http package. When an HTTP server sends a successful response to an HTTP/1 CONNECT request without taking raw control of the connection, it improperly continues to process incoming data as standard HTTP requests instead of establishing a tunnel. A remote attacker can...

net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses

A flaw was found in Go's net/http package. When an HTTP server sends a successful response to an HTTP/1 CONNECT request without taking raw control of the connection, it improperly continues to process incoming data as standard HTTP requests instead of establishing a tunnel. A remote attacker can...

net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses

A flaw was found in Go's net/http package. When an HTTP server sends a successful response to an HTTP/1 CONNECT request without taking raw control of the connection, it improperly continues to process incoming data as standard HTTP requests instead of establishing a tunnel. A remote attacker can...

net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses

A flaw was found in Go's net/http package. When an HTTP server sends a successful response to an HTTP/1 CONNECT request without taking raw control of the connection, it improperly continues to process incoming data as standard HTTP requests instead of establishing a tunnel. A remote attacker can...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling via free-socket reuse in the HTTP Agent. A remote HTTP peer can send response bytes that reach an idle keep-alive socket’s OS buffer before the event loop polls; the Agent may then reuse that socket and parse thos...

CVE-2026-86146 Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing

Inconsistent interpretation of HTTP requests HTTP request/response smuggling in the bundled HTTP/1.1 parser of Apache bRPC version 1.18.0 on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same byte...

CVE-2026-86146

Apache bRPC (versions

nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests

A flaw in nghttp2's nghttpx proxy allows a remote attacker to perform HTTP request smuggling and cross-client response-queue poisoning. This occurs because the proxy ambiguously forwards HTTP/1.1 Upgrade requests that contain a Content-Length header to reusable keep-alive backend connections...