Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by an HTTP request smuggling vulnerability

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is affected by an HTTP request smuggling vulnerability CVE-2026-11710 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected...

CVE-2026-67182-HTTP-Request-Smuggling-Enables-Front-End-Access-Control-Bypass-rouille-

Security Advisory: HTTP Request Smuggling Enables Front-End Access Control Bypass rouille Assigned CVE ID: CVE-2026-67182 Summary rouille::proxy::proxy and rouille::proxy::fullproxy copy client-supplied request header values into the upstream connection without checking them for control character...

CVE-2026-67181-HTTP-Request-Smuggling-via-Transfer-Encoding-Desynchronization-rouille-

Security Advisory: HTTP Request Smuggling via Transfer-Encoding Desynchronization rouille Assigned CVE ID: CVE-2026-67181 Summary rouille::proxy::proxy forwards the client's Transfer-Encoding header to the backend unchanged, but writes the request body that tinyhttp has already de-chunked. It nev...

request_smuggler

Request smuggler Http request smuggling vulnerability scanner Based on the amazing research by James Kettle. The tool can help to find servers that may be vulnerable to request smuggling vulnerability. Archived The tool needs a lot of improvements, and I don't have enough time to support it as I...

nodejs-http-transfer-encoding-smuggling-poc

nodejs-http-transfer-encoding-smuggling-poc PoC of HTTP Request Smuggling in nodejs CVE-2020-8287 src/index.js root@kitploit: header: 'Host', '127.0.0.1', 'Transfer-Encoding', 'chunked', 'Transfer-Encoding', 'eee' , body: 'A' header: 'Host', '127.0.0.1' , body: '' data: 'HTTP/1.1 200 OK\r\n' +...

CVE-2026-85078

A flaw was found in Sanic, an open-source Python web server/framework. A remote, unauthenticated attacker can exploit incomplete handling of HTTP/1.1 chunked-body requests. By injecting malicious data into the request's trailer section, the attacker can cause Sanic to process a hidden second...

CTF-Web-Exploitation

Nether Portal Desync HUUP "I travel not on established roads but leap freely across the void. Package me wrong, and I'll deliver a secret to the wrong doorstep." Description The challenge features an HTTP/3 QUIC application layered over UDP. Because UDP is stateless and the proxy doesn't enforce...

CVE-2025-55315

CVE-2025-55315 Proof-of-concept exploit for CVE-2025-55315 .NET HTTP Request Smuggling. Demonstrates how improperly parsed chunked encoding lets attackers smuggle requests past proxies and load balancers in vulnerable ASP.NET Core/Kestrel servers. 📊 Presentation View Interactive Prezi Presentatio...

CVE-2021-40346

CVE-2021-40346 请求头内部表示中的整数溢出允许 HTTP 请求走私。本仓库提供了一个使用 docker-compose 构建的 PoC，包含两个 docker 镜像：一个运行存在漏洞版本的 HaProxy（本例中为 2.2.16），另一个运行使用 Gunicorn 作为 WSGI 的 Flask Web 服务器。通过利用该漏洞，我们能够访问 /admin 页面，而该页面的请求本会被 HaProxy 通过用户自定义规则阻止。 POC 环境要求 Docker 🐳 Docker compose 🐳 环境配置 HaProxy docker 容器，端口 8000 映射到宿主机。...

CVE-2026-33555

Bypass de Validación del Cuerpo FIN Standalone en HAProxy H3/QUIC para Contrabando de Solicitudes HTTP Publicación completa aquí : https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html Resumen Una vulnerabilidad en la implementación HTTP/3 de HAProxy permite a un...

CVE-2025-55315-Scanner-Monitor

Escáner de Vulnerabilidad CVE-2025-55315 y Proxy TLS Este repositorio contiene herramientas para detectar y monitorear aplicaciones ASP.NET Core vulnerables a CVE-2025-55315, que implica contrabando de solicitudes HTTP HTTP request smuggling debido a encabezados HTTP conflictivos. Herramientas...

UBUNTU-CVE-2023-54397

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability...

Linux Distros Unpatched Vulnerability : CVE-2023-54397

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content- Length headers accepting non-standard characters...

CVE-2023-54397

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability...

CVE-2024-40725

HTTP Request Smuggling Detection Tool This repository contains a Python-based tool to detect HTTP Request Smuggling vulnerabilities, specifically targeting CVE-2024-40725. The tool attempts to exploit this vulnerability in Apache HTTP Server by sending crafted HTTP requests and analyzing the...

Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-11710)

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by an HTTP request smuggling vulnerability (CVE-2026-11710)

Summary IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by an HTTP request smuggling vulnerability. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Produc...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by an HTTP request smuggling vulnerability (CVE-2026-11710)

Summary IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by an HTTP request smuggling vulnerability. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products an...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by an HTTP request smuggling vulnerability (CVE-2026-11710)

Summary IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by an HTTP request smuggling vulnerability. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products and...

EUVD-2026-79025

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rules. When ember-server is behind a keep-alive intermediary...