CVE-2026-69217

Http4s (a Scala HTTP service interface) is vulnerable to CL.CL request smuggling due to its Ember HTTP/1.1 parser accepting differing duplicate Content-Length headers and using the last value instead of rejecting the message. Affected versions are prior to 0.23.35 and 1.0.0-M47 . When an Ember se...

tomcat-line-check

tomcat-line-check CVE-2026-24880 · GHSA-563x-q5rq-57qp —— Apache 那句 upgrade to version 11.0.20, 10.1.52 or 9.0.116 对你成不成立? 对多数人不成立,而且有四种不同的不成立方式。这个工具扫你的构件,告诉你是哪一种。 root@kitploit: java -jar tomcat-line-check.jar /path/to/tomcat 解压部署的 Tomcat java -jar tomcat-line-check.jar app.war war java -jar...

CVE-2026-73494 blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a...

CVE-2026-66731-Negative-Chunk-Size-Parsing-Causes-Memory-Corruption-leading-to-Server-Crash

Aviso de Seguridad: El Análisis de Tamaño de Fragmento Negativo Causa Corrupción de Memoria en facil.io ID de CVE asignado : CVE-2026-66731 Producto: facil.io Versiones afectadas: facil.io = 0.7.5 0.7.5, 0.7.6, master; introducido cuando el parser HTTP/1.1 de 0.8.x se retroportó en 0.7.5 - no...

CVE-2026-49846

libks provides foundational support for signalwire C products. Prior to version 2.0.11, cleanuri in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with...

CVE-2026-49846

libks , a foundational C library used by SignalWire products, contains a path traversal vulnerability in clean_uri(), its HTTP request parser. Prior to version 2.0.11 , URIs whose path exceeds the internal canonicalization buffer's segment capacity are silently passed through with embedded .. seq...

CVE-2026-49846 libks has path traversal in kws HTTP parser via URI segment overflow

libks provides foundational support for signalwire C products. Prior to version 2.0.11, cleanuri in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with...

CVE-2026-49846 libks has path traversal in kws HTTP parser via URI segment overflow

libks provides foundational support for signalwire C products. Prior to version 2.0.11, cleanuri in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with...

DEBIAN-CVE-2026-68006

An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/pumahttp11/http11parser.rl file...

CVE-2026-68006

An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/pumahttp11/http11parser.rl file...

EUVD-2026-71220

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. Two HTTP/1 response-parser states accumulate server data without any cap. In lib/mint/http1.ex, decodestatusline/4...

Astra Linux – Vulnerability in http-parser

Node.js versions before 10.23.1, 12.20.1, 14.15.4, and 15.5.1 allow for two copies of a header field in an HTTP request for example, two Transfer-Encoding header fields. In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling...

Astra Linux – Vulnerability in http-parser

HTTP request smuggling in Node.js versions 10, 12, and 13 causes the delivery of malicious payloads when transfer-encoding is malformed...

netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary

Summary io.netty.incubator:netty-incubator-codec-bhttp can enter a non-terminating parse loop when a known-length Binary HTTP field section ends exactly after a complete field line. A remote peer that can send Binary HTTP input to a Netty pipeline using BinaryHttpParser / BinaryHttpDecoder can us...

GHSA-8CFX-WX3Q-MH5Q netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary

Summary io.netty.incubator:netty-incubator-codec-bhttp can enter a non-terminating parse loop when a known-length Binary HTTP field section ends exactly after a complete field line. A remote peer that can send Binary HTTP input to a Netty pipeline using BinaryHttpParser / BinaryHttpDecoder can us...

AZL-96944 CVE-2026-63382 affecting package libevent for versions less than 2.1.13-1

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

EUVD-2026-58619

actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backe...

CVE-2026-73051 actix-http before 3.12.1 HTTP Request Smuggling via CL.TE

actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backe...

Security Bulletin: IBM Operational Decision Manager for July 2026 - Multiple CVEs addressed

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Operational Decision Manager Vulnerability Details CVEID:CVE-2025-11143 DESCRIPTION: The Jetty URI parser has some key differences to other common parsers when...

SUSE SLES15 Security Update : nodejs24 (SUSE-SU-2026:3520-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3520-1 advisory. Update to 24.18.1. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF an...