PT-2026-130617

A authorization bypass vulnerability exists in the /nodered functionality of FUXA versions: 1.3.2-2809. A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability...

CVE-2026-115817

A flaw was found in Starman. A remote attacker can cause a Denial of Service DoS by sending complete HTTP request headers and then stalling or slowly transmitting the request body. Because request bodies are read without enforcing an active timeout deadline, worker processes remain blocked...

CVE-2025-55702

A flaw was found in Apache Traffic Server. When a client sends a POST request with an Expect header and the origin server responds before consuming the full body, Traffic Server incorrectly parses the remaining unread body as a subsequent request. A remote attacker behind a front-end proxy sharin...

Security Bulletin: IBM Rational Developer for i is affected by Multiple vulnerabilities

Summary IBM Rational Developer for i is affected by an HTTP request smuggling vulnerability in Jetty-http CVE-2026-19203, two authentication bypass vulnerabilities in sshd-osgi CVE-2026-77185, CVE-2026-93994, two memory exhaustion vulnerabilities in sshd-sftp CVE-2026-94002, CVE-2026-94029, an...

Security Bulletin: IBM Datapower Operations Dashboard is vulnerable to HTTP request smuggling attacks CVE-2026-33870

Summary Netty is used by the IBM Datapower Operations Dashboard as part of their server implementation. Vulnerability Details CVEID:CVE-2026-33870 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty...

Rocky Linux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.6:CLSA-2026:1793105536)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793105536 advisory. - Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names e.g., Content-Length and...

Linux Distros Unpatched Vulnerability : CVE-2026-114216

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an...

AlmaLinux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.6:CLSA-2026:1793105536)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793105536 advisory. - Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names e.g., Content-Length and...

Allocation of Resources Without Limits or Throttling

Overview @modelcontextprotocol/server is a Model Context Protocol implementation for TypeScript - Server package Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded HTTP request body reading in the Hono middleware handler. An...

Allocation of Resources Without Limits or Throttling

Overview @modelcontextprotocol/node is a Model Context Protocol implementation for TypeScript - Node.js middleware Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded HTTP request body reading in the Hono middleware handler. An...

SUSE CVE-2026-112880

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in hackneyhttpconnect in benoitc hackney allows HTTP Request Splitting via the value a proxyauthfun callback returns. After a 407 response from an HTTP CONNECT proxy,...

net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses

A flaw was found in Go's net/http package. When an HTTP server sends a successful response to an HTTP/1 CONNECT request without taking raw control of the connection, it improperly continues to process incoming data as standard HTTP requests instead of establishing a tunnel. A remote attacker can...

dotnet: ASP.NET Core Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network...

dotnet: ASP.NET Core Tampering Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

CLEANSTART-2026-IO26222 Inconsistent interpretation of http requests ('http request/response smuggling') in ASP

Security vulnerability affects the azure-functions-host package. Inconsistent interpretation of http requests 'http request/response smuggling' in ASP...

CLEANSTART-2026-YW87964 Inconsistent interpretation of http requests ('http request/response smuggling') in ASP

Security vulnerability affects the azure-functions-host package. Inconsistent interpretation of http requests 'http request/response smuggling' in ASP...

CentOS Linux 8.4 [TuxCare] Security Update: pcs / pcs-snmp Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1793141050)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1793141050 advisory. - Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files. CVE-2022-29970 - Tornad...

AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.2:CLSA-2026:1793099189)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793099189 advisory. - Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names e.g., Content-Length and...

ROS-20261027-73-0058

The vulnerability in Tomcat 10 is related to flaws in handling HTTP requests. Exploitation of this vulnerability allows a remote attacker to send hidden HTTP requests an HTTP request smuggling attack...

ROS-20261027-73-0059

The vulnerability in Tomcat 11 is related to flaws in handling HTTP requests. Exploitation of this vulnerability allows a remote attacker to send hidden HTTP requests an HTTP request smuggling attack...