io.micronaut:micronaut-function-client (2.0.2), io.micronaut:micronaut-tracing (2.0.2) potentially affected by unknown CVE via io.micronaut:micronaut-http-client (2.0.2)

io.micronaut:micronaut-http-client MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-function-client 2.0.2 - io.micronaut:micronaut-tracing 2.0.2 Source...

fr.cnieg.demo:demo (>=4.0.1, <=4.0.3), io.micronaut.starter:micronaut-micronaut-cli (2.2.2) +4 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (2.2.2)

io.micronaut:micronaut-http-client MAVEN version 2.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - fr.cnieg.demo:demo =4.0.1, =4.0.3 - io.micronaut.starter:micronaut-micronaut-cli 2.2.2 -...

io.micronaut.configuration:micronaut-aws-common (1.0.2), io.micronaut.configuration:micronaut-netflix-ribbon (1.0.2) +3 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.0.2)

io.micronaut:micronaut-http-client MAVEN version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut.configuration:micronaut-aws-common 1.0.2 -...

io.micronaut.configuration:micronaut-security-oauth2 (2.0.0.m1), io.micronaut:micronaut-discovery-client (2.0.0.m1) +2 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (2.0.0.m1)

io.micronaut:micronaut-http-client MAVEN version 2.0.0.m1 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut.configuration:micronaut-security-oauth2 2.0.0.m1 -...

io.micronaut.aws:micronaut-function-aws-api-proxy (>=1.4.0.m2, <=1.4.1), io.micronaut.aws:micronaut-function-aws-custom-runtime (>=1.4.0.m2, <=1.4.1) +5 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.2.10)

io.micronaut:micronaut-http-client MAVEN version 1.2.10 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut.aws:micronaut-function-aws-api-proxy =1.4.0.m2, =1.4.0.m2, =1.4.0.m1, =1.4.1 ...

io.micronaut.starter:micronaut-micronaut-cli (2.3.1), io.micronaut.starter:micronaut-starter-api (2.3.1) +3 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (2.3.1)

io.micronaut:micronaut-http-client MAVEN version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut.starter:micronaut-micronaut-cli 2.3.1 -...

PT-2026-58938

The Netty-based Micronaut HTTP Client does not impose a limit on HTTP redirections, potentially allowing an infinite redirect loop that could lead to a denial-of-service attack. Patches The following versions are patched: - For Micronaut 5, versions equal or greater than 5.0.1 = - For Micronaut 4...

PYSEC-2026-3444

httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small...

AZL-92295 CVE-2026-59939 affecting package python-httplib2 0.20.3-3

httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small...

CVE-2026-59939

httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small...

CVE-2026-55688

A flaw was found in the AsyncHttpClient AHC library. The ThreadSafeCookieStore component did not properly verify the domain attribute of cookies, allowing a malicious host to set a cookie for an unrelated domain. This cookie would then be sent by the client in subsequent requests to the targeted...

BlackSheep's ClientSession is vulnerable to CRLF injection

ImpactThe HTTP Client implementation in BlackSheep is vulnerable to CRLF injection. Missing headers validation makes it possible for an attacker to modify the HTTP requests e.g. insert a new header or even create a new HTTP request.Exploitation requires developers to pass unsanitized user input...

GO-2026-5890 Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect in github.com/kerberos-io/agent/machinery

Kerberos Hub private key X-Kerberos-Hub-PrivateKey leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect in github.com/kerberos-io/agent/machinery...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Python vulnerabilities (USN-8509-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8509-1 advisory. It was discovered that Python incorrectly normalized paths in the tarfile module. An attacker could possibly use this issue to...

USN-8509-1: Python vulnerabilities

It was discovered that Python incorrectly normalized paths in the tarfile module. An attacker could possibly use this issue to bypass path restrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. CVE-2025-13462 It was discovered that Python's HTMLParser incorrectly handled...

Sensitive Cookie with Improper SameSite Attribute

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Sensitive Cookie with Improper SameSite Attribute via ThreadSafeCookieStore in ThreadSafeCookieStore.add.... An attacker can plant a cookie f...

ai.evolv:ascend-sdk (0.5.0), ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6) +2877 more potentially affected by CVE-2026-55688 via org.asynchttpclient:async-http-client (>=2.0.0-alpha13, <=2.15.0)

org.asynchttpclient:async-http-client MAVEN version =2.0.0-alpha13, =1.7, =4.1.0, =4.2.14, =4.1.0, =4.1.0, =4.1.0, =4.2.14, =3.5.5, =3.5.5, =3.5.5, =3.5.7-jre7.0 and more Source cves: CVE-2026-55688 Source advisory: SNYK:JAVA-ORGASYNCHTTPCLIENT-17796414...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.1-rc.1, <=6.0.4), com.arpnetworking.metrics:mad-experimental (>=1.2.3, <=1.2.11) +96 more potentially affected by CVE-2026-55688 via org.asynchttpclient:async-http-client (>=3.0.0.beta1, <=3.0.10)

org.asynchttpclient:async-http-client MAVEN version =3.0.0.beta1, =6.0.1-rc.1, =1.2.3, =1.22.2, =1.13.6, =1.1.0, =0.4.7, =0.4.7, =0.4.7, =1.17.0, =1.17.0, =1.17.0, =0.5.0, =0.0.9, =2.7.3, =2.8.5 and more Source cves: CVE-2026-55688 Source advisory: SNYK:JAVA-ORGASYNCHTTPCLIENT-17796414...

DEBIAN-CVE-2026-55688

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In versions from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior to 3.0.11, ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without...

CVE-2026-55688

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In versions from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior to 3.0.11, ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without...