4075 matches found
CVE-2026-67297
FreeRDP before 3.29.0 fails to enforce the RESPONSESIZELIMIT when processing Transfer-Encoding: chunked HTTP responses in httpresponserecvbody. Attackers controlling a malicious RD Gateway endpoint can send oversized chunked response bodies to exhaust client memory resources without triggering th...
CVE-2026-67297
FreeRDP prior to 3.29.0 contains a flaw in http_response_recv_body() where RESPONSE_SIZE_LIMIT is not enforced for Transfer-Encoding: chunked HTTP responses. This allows an attacker controlling a malicious RD Gateway endpoint to send oversized chunked bodies, exhausting memory on the client. Impa...
SUSE CVE-2026-39882
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters traces/metrics/logs read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...
IBM WebSphere Application Server Input Validation Vulnerability (CNVD-2026-31548)
IBM WebSphere Application Server is an application server product developed by IBM. There is a security vulnerability in IBM WebSphere Application Server, which stems from improper handling of HTTP version tokens. Attackers can exploit this vulnerability to perform HTTP response smuggling attacks...
UBUNTU-CVE-2026-16728
undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty...
CVE-2026-15064
CVE-2026-15064 affects IBM WebSphere Application Server 9.0, IBM WebSphere Application Server 8.5, and IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.7. The issue is a vulnerability to HTTP Response Smuggling caused by improper handling of non-standard HTTP version tokens. The c...
CVE-2026-15064 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens...
CVE-2026-66746
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...
CVE-2026-66746 Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...
CVE-2026-66746 Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...
CVE-2026-66746
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...
CVE-2026-66746
Rouille 0.4.0–3.6.2 contains an HTTP response splitting vulnerability. An attacker can inject CR/LF into attacker-controlled input, causing arbitrary response headers to be added via reflected percent-decoded query parameters or bare LF in Cookie headers into Set-Cookie headers. This enables cach...
PT-2026-65583
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens...
httpd: incomplete fix for CVE-2023-38709
A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers. These issues lead to HTTP response splitting. This CVE provides a "complete" fix for CVE-2023-38709...
HTTP Response Splitting
Overview vrana/adminer is a Database management in a single file. Affected versions of this package are vulnerable to HTTP Response Splitting via the X-Forwarded-Prefix HTTP header. An attacker can manipulate cookie attributes by injecting arbitrary values into the Set-Cookie path attribute,...
CVE-2026-59249
The CVE concerns the Elixir Mint library (mint) and its HTTP/1.1 decoding path. Specifically, Mint.HTTP1.decode_body/5 parses chunk-size lines using Integer.parse(data, 16), which accepts a leading + or - despite RFC 7230 requiring unsigned hex digits. This leads to a mismatch with RFC-strict int...
CVE-2026-15714
An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soupmultipartinputstreamreadheaders function inside soup-multipart-input-stream.c, which does not adequately restrict or validate the size of incoming multipart boundary strings. When...
CVE-2025-62675
An Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' vulnerability CWE-113 vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4 all versions, FortiProxy 7.2 all...
