CVE-2026-19203

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

CVE-2026-19203

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

CVE-2026-19203

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

EUVD-2026-72718

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

CVE-2026-19203

Eclipse Jetty is vulnerable to HTTP request smuggling due to acceptance of a lone LF character as a terminator in HTTP/1.1 chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, the misinterpretation may occur in chunk extensions, chunk data termination, or t...

CVE-2026-86590

Eclipse Che versions 7.79.0 through 7.121.0 contain a server-side request forgery (SSRF) in the dashboard backend's POST /dashboard/api/data/resolver endpoint. The endpoint passes a caller-supplied URL directly to an outbound HTTP GET request with no host filtering, and the operator-configured al...

CVE-2026-19203: Inconsistent Interpretation of HTTP Requests

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

PT-2026-87042

Name of the Vulnerable Software and Affected Versions Jetty affected versions not specified Description An issue exists where a client can send specially crafted HTTP/1.1 chunked requests that cause the server and an intermediary proxy to interpret request boundaries differently, potentially...

EulerOS 2.0 SP12 : libsoup (EulerOS-SA-2026-3278)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine...

Workflow session email approval process bypass

...

Cron Job Injection in Remote Backup

...

ROS-20260908-73-0044

The vulnerability in python-daphne is related to deficiencies in handling HTTP requests. Exploiting this vulnerability allows a remote attacker to send hidden HTTP requests a type of HTTP request smuggling attack...

CVE-2026-81356: Inconsistent Interpretation of HTTP Requests

Inconsistent interpretation of http requests 'http request/response smuggling' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues: CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate bsc1273125. CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure bsc1273553...

Security update for nghttp2

This update for nghttp2 fixes the following issue: CVE-2026-58055: HTTP/1.1 Upgrade request can lead to HTTP request smuggling and cross-client response-queue poisoning bsc1269489. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate...

ROS-20260907-73-0064

The vulnerability of the Skia component in Google Chrome and Microsoft Edge is related to errors in HTTP request processing. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260907-73-0096

The vulnerability in dotnet10.0 is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to send hidden HTTP requests remotely a type of HTTP request smuggling attack...

ROS-20260907-73-0095

The vulnerability in dotnet8.0 is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to send hidden HTTP requests remotely a type of HTTP request smuggling attack...

ROS-20260907-73-0094

The vulnerability in dotnet9.0 is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to send hidden HTTP requests remotely a type of HTTP request smuggling attack...

OESA-2026-3690 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTT...