Apache Tomcat - HTTP Request Smuggling

Apache Tomcat from versions 8.5.0 to 8.5.93, 9.0.0-M1 to 9.0.81, 10.1.0-M1 to 10.1.13, and 11.0.0-M1 to 11.0.0-M11 contain an improper input validation caused by incorrect parsing of HTTP trailer headers, letting attackers craft headers to cause request smuggling, exploit requires sending malicio...

smugglefuzz

SmuggleFuzz SmuggleFuzz, uno scanner di smuggling HTTP di downgrade configurabile e rapido. Consente agli utenti di personalizzare le liste di gadget, offrendo approfondimenti sulle cause degli attacchi di smuggling falliti. Sono convinto che molte vulnerabilità di smuggling basate su downgrade...

node-poc-http-smuggling

Questo repository non contiene un README...

CVE-2021-40346

CVE-2021-40346 CVE-2021-40346 PoC HAProxy HTTP Smuggling Solo a scopo educativo Configurazione $ docker build -t cve-2021-40346 . $ docker run --name poc -p 8000:80 -d --rm -it cve-2021-40346 4941e9f23508b497e4cbe334a75e7cdb84c83478522ed85f48db3477f97a6fb4 Test Conferma che /admin è negato. $ cur...

CVE-2021-40346-POC

CVE-2021-40346-POC L'overflow di interi CVE-2021-40346 consente lo smuggling HTTP Smuggling di richieste HTTP causato da overflow di interi Analisi in cinese: Analisi della vulnerabilità di smuggling delle richieste HAProxy CVE-2021-40346 Riferimento:...

BurpSuiteHTTPSmuggler

Burp Suite HTTP Smuggler Eine Burp-Suite-Erweiterung, die Pentestern hilft, WAFs zu umgehen oder deren Wirksamkeit mithilfe einer Reihe von Techniken zu testen. Diese Erweiterung wurde von Soroush Dalili @irsdl von der NCC Group entwickelt. Die erste Version v0.1 unterstützt nur die...

CVE-2019-20372

CVE-2019-20372 Questo repository è solo a scopo educativo. /server server vulnerabile esegui ./server.sh /exploit.py script exploit esegui python3 exploit.py importante! https://blkcipher.pl/assets/pdfs/2019-12-10-errorpagerequestsmuggling.pdf https://github.com/vuongnv3389-sec/CVE-2019-20372...

CVE-2021-3064

CVE-2021-3064: Pan-OS Buffer Overflow Remoto + Contrabbando HTTP Exploit Questo exploit sfrutta una vulnerabilità di HTTP Smuggling per consegnare un payload a un endpoint altrimenti inaccessibile sui firewall Pan-OS; l'endpoint è vulnerabile a un overflow che può essere sfruttato per eseguire...

Security Bulletin: IBM Watson Explorer is affected by a vulnerability in IBM WebSphere Application Server Liberty

Summary IBM Watson Explorer contains a vulnerable version of IBM WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2026-14981 DESCRIPTION: IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the...

CVE-2026-82672

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent requests that...

EUVD-2026-83608

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent requests that...

EEF-CVE-2026-82672 Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections

Summary Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent request...

[SECURITY] [DLA 4786-1] libevent security update

Debian LTS Advisory DLA-4786-1 [email protected] https://www.debian.org/lts/security/ Andreans Henriksson September 18, 2026 https://wiki.debian.org/LTS Package : libevent Version : 2.1.12-stable-8+deb12u1 CVE ID : CVE-2026-63379 CVE-2026-63381 CVE-2026-63382 CVE-2026-63383 CVE-2026-633...

EulerOS Virtualization 2.12.1 : nghttp2 (EulerOS-SA-2026-3601)

According to the versions of the nghttp2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body ont...

Debian dla-4786 : libevent-2.1-7 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4786 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4786-1 [email protected]...

libevent security update

2.1.8-11 - Fix CVE-2026-63385: HTTP header injection via CRLF in header values - Resolves: RHEL-253566 2.1.8-10 - Fix CVE-2026-63387: out-of-bounds write in evdns dnsnametolabels - Resolves: RHEL-249889 2.1.8-9 - Fix CVE-2026-63383: out-of-bounds read in decodetaginternal - Resolves: RHEL-250240...

EUVD-2023-60690

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain...

Astra Linux – Vulnerability in HAPProxy

There is an integer overflow in HAProxy versions 2.0 to 2.5, specifically in the htxaddheader function, which can be exploited to perform an HTTP request smuggling attack. This allows an attacker to bypass all configured http-request HAProxy Access Control Lists and possibly other access control...

Astra Linux – Vulnerability in Netty

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace such as a spaceTransfer-Encoding:chunked line and a later Content-Length header. This issue exists due to an incomplete fix for CVE-2019-16869...

Security Bulletin: IBM MQ is affected by a vulnerability in IBM WebSphere Application Server Liberty (CVE-2026-11806)

Summary An arbitrary file read vulnerability was identified in IBM WebSphere Application Server Liberty, which IBM MQ ships and uses to supply IBM MQ Console and IBM MQ REST API functionality Vulnerability Details CVEID:CVE-2026-11806 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0...