CVE-2021-40346

CVE-2021-40346: HAProxy HTTP 요청 스머글링 - ACL 우회 개요 이 프로젝트는 HAProxy의 중요한 정수 오버플로 취약점인 CVE-2021-40346 을 시연하며, 이 취약점을 통해 HTTP 요청 스머글링 공격으로 보안 제어를 우회할 수 있습니다. CVSSv3 점수: 7.5 높음 기여자: 1. Boian Eduard 2. Borsos Matheas-Roland CVE-2021-40346이란? CVE-2021-40346은 HAProxy의 HTTP 헤더 파싱 로직에서 발생하는 정수 오버플로 취약점 입니다...

SAPGateBreaker-Exploit

CVE-2022-22536: SAP의 앞문을 통한 HTTP 스마글링 SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 및 SAP Web Dispatcher는 요청 스마글링 및 요청 연결에 취약합니다. 인증되지 않은 공격자는 피해자의 요청 앞에 임의의 데이터를 추가할 수 있습니다. 이러한 방식으로 공격자는 피해자를 가장하여 기능을 실행하거나 중간 웹 캐시를 오염시킬 수...

CVE-2021-40346

CVE-2021-40346 — HAProxy Integer Overflow leading to HTTP Request Smuggling 취약점 요약 HAProxy는 오픈소스 기반 리버스 프록시 겸 로드 밸런서로, 부하 분산 및 ACL접근 제어 규칙 처리 등을 담당하는 소프트웨어임 CVE-2021-40346은 HAProxy가 HTTP 헤더를 내부 HTX 포맷으로 저장하는 htxaddheader 함수에서 헤더 이름Header Name의 길이를 검증하지 않는 과정에서 발생하는 접근 제어 우회ACL Bypass 취약점 이 취약점은...

CVE-2026-82672 Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent requests that...

DEBIAN-CVE-2026-93562

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls ...

CVE-2026-11722

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability...

CVE-2026-11710

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers...

CVE-2026-11548

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability...

CVE-2026-93562

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls ...

EUVD-2026-83386

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls ...

CVE-2026-93574

A flaw was found in Netty's netty-codec-http component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an...

CVE-2026-93574

CVE-2026-93574 affects Netty's netty-codec-http component, where an incorrect parsing of HTTP/1.1 chunk-size tokens containing post-digit whitespace enables HTTP request smuggling . A remote attacker with no privileges can exploit this over the network to bypass security controls or access unauth...

EUVD-2026-83385

A flaw was found in Netty's netty-codec-http component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an...

EUVD-2026-83290

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability...

CVE-2026-11722 Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability...

CVE-2026-11722

CVE-2026-11722 is an HTTP request smuggling vulnerability (CWE-444) affecting IBM WebSphere Application Server (versions 8.5 and 9.0) and WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8). The vulnerability requires no authentication and has high attack complexity, with lo...

EUVD-2026-83287

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers...

CVE-2026-11710 IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerability

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers...

CVE-2026-11710

IBM WebSphere Application Server 8.5 (versions 8.5.5.0 through 8.5.5.30) is vulnerable to HTTP request smuggling caused by improper handling of Content-Length headers (CWE-444). The flaw allows an attacker to send crafted requests that are interpreted differently by the server versus downstream c...

EUVD-2026-83281

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability...