428 matches found
CVE-2026-59900
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer "Http2StreamFrameToHttpObjectCodec" and "InboundHttp2ToHttpAdapter" fails to deduplicate or validate "Host" headers when an HTTP/2...
CVE-2026-59900: Inconsistent Interpretation of HTTP Requests
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter fails to deduplicate or validate Host headers when an HTTP/2 client...
CVE-2026-58153: Inconsistent Interpretation of HTTP Requests
Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue...
CVE-2026-64785: Inconsistent Interpretation of HTTP Requests
SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2...
PT-2026-63548
Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description The HTTP/2-to-HTTP/1.x translation layer, specifically within Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter, fails to deduplicate or...
PT-2026-95658
Name of the Vulnerable Software and Affected Versions Suricata versions 8.0.0 through 8.0.5 Description The HTTP/1 parser limits decompression work per transaction but fails to limit the number of small brotli compression bombs a single flow can submit. When the response-body-decompress-layer-lim...
CVE-2026-6790: Improper Input Validation
In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present. This was not enforced in earlier HTTP RFC for example, in RFC 2616, but it is in the latest RFC 9110 and 9112. This...
CVE-2026-48743: Inconsistent Interpretation of HTTP Requests
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, Envoy can translate a downstream HTTP/3 request that is complete at the transport layer HEADERS with FIN / headers-only close but still carries a nonzero...
CVE-2026-28980
The "HTTPDecoder" in "NIOHTTP1" enforces no limit on the total size of an HTTP/1 message's header block or on the number of header fields per message. A remote peer can submit an arbitrary number of small, valid headers in a single request and have them all accumulated into the resulting...
CVE-2026-45373
CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, although SSRF is validated against hostnames that resolve to private IPv6 addresses, when providing the IPV6 in URL as http://::1, the SSRF defenses do not work. This vulnerability is fixed in 0.8.26...
CVE-2026-45373: Server-Side Request Forgery (SSRF)
CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, although SSRF is validated against hostnames that resolve to private IPv6 addresses, when providing the IPV6 in URL as http://::1, the SSRF defenses do not work. This vulnerability is fixed in 0.8.26...
CVE-2026-39803
Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion. The chunked clause of 'Elixir.Bandit.HTTP1.Socket':readdata/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :length option when...
CVE-2026-39803: Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion. The chunked clause of 'Elixir.Bandit.HTTP1.Socket':readdata/2 in lib/bandit/http1/socket.ex ignores the caller-supplied :length option when...
AZL-84683 CVE-2026-2708 affecting package libsoup for versions less than 3.4.4-16
A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soupmessageheadersappendcommon function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker...
SUSE: CVE-2026-2708: SUSE Linux Security Advisory
A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soupmessageheadersappendcommon function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker...
CVE-2026-40396: Always-Incorrect Control Flow Implementation
Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service daemon panic after timeoutlinger. A malicious client could send an HTTP/1 request, wait long enough until the session releases its worker thread timeoutlinger and resume traffic before the session is closed timeoutidle...
PT-2025-42518
Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.36.1 Envoy versions prior to 1.35.5 Envoy versions prior to 1.34.9 Envoy versions prior to 1.33.10 Description Envoy is a cloud-native, open source edge and service proxy. Large requests and responses can potentially...
CVE-2025-62409: NULL Pointer Dereference
Envoy is a cloud-native, open source edge and service proxy. Prior to 1.36.1, 1.35.5, 1.34.9, and 1.33.10, large requests and responses can potentially trigger TCP connection pool crashes due to flow control management in Envoy. It will happen when the connection is closing but upstream data is...
