axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization

A flaw was found in Axios. A remote attacker or an unresponsive endpoint can cause a Denial of Service DoS by triggering an error during HTTP/2 session initialization or reuse. Because the underlying session fails to register proper error handlers, network or session failures result in an uncaugh...

axios: axios: Request socket hijacking via inherited createConnection property

A flaw was found in axios. When running in Node.js, the HTTP adapter does not define an explicit connection creation setting on outgoing request options. If a separate prototype-pollution flaw is exploited in the same process, an attacker can hijack the network socket by injecting a malicious...

axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings

A flaw was found in axios. When processing HTTP/2 requests, the client fails to enforce configured proxy settings and custom Domain Name System DNS resolution policies. A remote attacker who can influence destination URLs could exploit this vulnerability to bypass outbound network restrictions,...

axios: Axios: HTTP header injection via inherited prototype properties

A flaw was found in Axios. If a separate vulnerability modifies shared object properties prototype pollution in the application environment, Axios may inherit those properties when processing request configurations rebuilt without explicit headers. An attacker can exploit this condition to inject...

axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter

A flaw was found in Axios. This vulnerability allows an attacker to manipulate outbound network traffic by injecting arbitrary HTTP Hypertext Transfer Protocol headers. In environments where an attacker can exploit a separate prototype pollution flaw to modify shared object properties, the Axios...

axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization

A flaw was found in Axios. A remote attacker or an unresponsive endpoint can cause a Denial of Service DoS by triggering an error during HTTP/2 session initialization or reuse. Because the underlying session fails to register proper error handlers, network or session failures result in an uncaugh...

axios: axios: Unintended HTTP method override via prototype pollution gadget

A flaw was found in axios. When sending HTTP requests that omit an explicit request method, Axios can inherit properties from the JavaScript prototype chain rather than using safe internal defaults. If an attacker manipulates shared object properties through a separate vulnerability in the same...

axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings

A flaw was found in axios. When processing HTTP/2 requests, the client fails to enforce configured proxy settings and custom Domain Name System DNS resolution policies. A remote attacker who can influence destination URLs could exploit this vulnerability to bypass outbound network restrictions,...

axios: axios: Denial of Service via crafted redirect hostname

A flaw was found in axios. A remote attacker operating a malicious server can cause a Denial of Service DoS by returning an HTTP redirect containing a crafted hostname. When proxy bypass settings are configured, the application processes the hostname with an inefficient regular expression that...

axios: Axios: HTTP header injection via inherited prototype properties

A flaw was found in Axios. If a separate vulnerability modifies shared object properties prototype pollution in the application environment, Axios may inherit those properties when processing request configurations rebuilt without explicit headers. An attacker can exploit this condition to inject...

axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter

A flaw was found in Axios. This vulnerability allows an attacker to manipulate outbound network traffic by injecting arbitrary HTTP Hypertext Transfer Protocol headers. In environments where an attacker can exploit a separate prototype pollution flaw to modify shared object properties, the Axios...

httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc

A flaw was found in the modxml2enc module of the Apache HTTP Server. An untrusted backend server can cause a Denial of Service DoS by returning a crafted response with a character set whose conversion partially succeeds and then fails. Processing this response triggers an invalid memory access nu...

httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference

A flaw was found in the modheartmonitor module of the Apache HTTP Server. A remote, unauthenticated attacker can exploit a NULL pointer dereference vulnerability when the module is configured with a unicast listener. By sending specially crafted network traffic to the listening service, an attack...

httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi

A flaw was found in the modproxyuwsgi module of Apache HTTP Server. This issue allows HTTP response smuggling when the server processes a crafted uWSGI response containing a Transfer-Encoding header. A remote attacker can exploit this vulnerability to desynchronize HTTP communications, potentiall...

httpd: httpd: Information disclosure via direct request to the WebDAV state directory

A flaw was found in the moddavfs module of the Apache HTTP Server. A remote attacker can exploit this vulnerability by sending an HTTP GET request directly to the internal WebDAV Web Distributed Authoring and Versioning state directory. This allows unauthorized access to internal state files,...

httpd: httpd: Information disclosure in mod_userdir via single-dot path equivalence

A flaw was found in Apache HTTP Server's moduserdir module. When configured with an absolute path without wildcards for the UserDir directive, the server fails to properly resolve single-dot directory '/./' path equivalence. A remote attacker can exploit this issue by submitting a crafted HTTP...

httpd: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy

A flaw was found in the modhttp2 module of Apache HTTP Server. A remote, unauthenticated attacker could exploit a use-after-free condition—where memory is accessed after being released—through re-entrant processing of shared session buffers. This flaw can allow an attacker to potentially execute...

httpd: httpd: Information disclosure via session cookie leakage during internal redirects

A flaw was found in Apache HTTP Server's modsessioncookie module. When internal redirects alter the SessionCookieRemove configuration, the server may fail to strip the session cookie as expected. This issue can lead to information disclosure by inadvertently forwarding sensitive user session toke...

httpd: httpd: Denial of Service via mod_rewrite lookahead

A use-after-free flaw was found in the modrewrite module of Apache HTTP Server when evaluating URL lookahead expressions that reference HTTP request headers, such as %LA-U:HTTP:.... A remote attacker may be able to trigger invalid memory access in a server using an affected rewrite configuration,...

httpd: Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function

A flaw was found in the modssl module of Apache HTTP Server. The SSLRequire directive does not properly restrict file-related expression functions in .htaccess files. An attacker who can write an .htaccess file in a directory where SSLRequire is permitted could use these functions to read files...