CVE-2026-110835 FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

CVE-2026-110835 FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

CVE-2026-110835

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

CVE-2026-94265

When processing an HTTP redirect to a URL containing userinfo a "username:password" component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl...

CVE-2026-87862

Importing a "includeSubDomains" parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS...

CVE-2017-14980.RCE

CVE-2017-14980 The exploit targets Sync Breeze Enterprise running on Windows 10 x86, build: 16299 , affecting version 10.0.28 , where an unauthenticated attacker can perform a buffer overflow via an HTTP-request body , resulting in arbitrary code execution. This exploit assumes all security...

undici: undici: Denial of Service via failed HTTP/2 WebSocket handshake

A flaw was found in undici. A malicious remote server can cause a Denial of Service DoS by returning an invalid handshake response when a client attempts to establish a WebSocket connection over HTTP/2. The client mishandles the failed connection setup and leaves the underlying network stream ope...

curl: Explicit NO_PROXY /0 CIDR rules fail to bypass HTTP proxy for IP-literal requests

Summary: With an HTTP proxy configured, I found that curl sends IPv4 address-literal requests through it with NOPROXY=0.0.0.0/0, and IPv6 address-literal requests through it with NOPROXY=::/0. A zero-bit CIDR prefix should match every address in its family, so those requests should bypass the...

cve-2021-41773-exploration

Overview CVE-2021-41773 is a path traversal vulnerability discovered in Apache HTTP Server 2.4.49 in October 2021. The root cause was a failure to properly normalize dot sequences ended into the URL before checking whether requested path stayed within the web root. This vulnerability allowed an...

HTTP Request Smuggling

Overview io.vertx:vertx-core is a tool-kit for building reactive applications on the JVM. Affected versions of this package are vulnerable to HTTP Request Smuggling due to inconsistent interpretation of headers in the isContentLength and isContentType helpers of the VertxHttpRequestDecoder class,...

it355-lab4-enterprise-lan-security

IT355 Lab 4: Enterprise LAN Security & Shellshock Analysis 📌 Project Overview This repository contains a comprehensive security assessment of an enterprise LAN environment. The core focus of this project was the identification, exploitation, and remediation of the Shellshock CVE-2014-6271...

CVE-2026-103930

cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::openstream in httplib.h accepts a caller-controlled path that reaches detail::writerequestline without the detail::encodepath protection used by the ordinary buffered request path. Raw carriage-return and...

CVE-2026-102479

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as...

CVE-2026-109527

A flaw was found in mcp. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service DoS by exhausting system memory. Affected HTTP endpoints buffer incoming request bodies in memory without enforcing a maximum size limit. By sending excessively large or streamed...

CVE-2026-102479

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as...

CVE-2026-102479

The io.vertx:vertx-core component in Eclipse Vert.x versions [5.0.0, 5.0.12] , [5.1.0, 5.1.9] , or [5.2.0, 5.2.0] contains a vulnerability in the HTTP/1.x decoder . The root cause is an improper canonicalization process for well-known HTTP headers, which allows crafted headers (e.g., Content-Xeng...

CVE-2026-102479

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as...

Apprise forwards configured auth headers across cross-origin HTTP redirects

Summary Apprise's HTTP-based notification plugins and its HTTP attachment / config loaders apprise/attachment/http.py, apprise/config/http.py follow HTTP 3xx redirects by default and re-send the user-configured auth headers and query parameters on the redirected request. If an operator-configured...

CVE-2026-102748

Dgraph, an open source distributed GraphQL database, is vulnerable to a Denial of Service in versions prior to 25.4.0 . When the administrative interface is enabled, Dgraph Zero registers several unauthenticated administrative HTTP routes on port 6080, specifically in dgraph/cmd/zero/run.go. An u...

EUVD-2026-101602

Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An unauthenticated attacker on the same local network who can capture the network traffic associated with legitimate administrator login may be able to derive a...