138555 matches found
CVE-2026-63718
Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' response smuggling vulnerability in Apache HTTP Server via modproxyuwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.68...
UBUNTU-CVE-2026-57941
Use After Free vulnerability in Apache HTTP Server's modhttp2 via shared session-bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
UBUNTU-CVE-2026-63718
Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' response smuggling vulnerability in Apache HTTP Server via modproxyuwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.68...
CVE-2026-56153
Out-of-bounds Write vulnerability in Apache HTTP Server's modcharsetlite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
CVE-2026-56154
Use After Free vulnerability in Apache HTTP Server's modrewrite when using lookahead %LA-U:HTTP:... This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
CVE-2026-56449
Out-of-bounds Write vulnerability in Apache HTTP Server's modproxyhtml with crafted HTTP response bodies. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
CVE-2026-57941
Use After Free vulnerability in Apache HTTP Server's modhttp2 via shared session-bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
CVE-2026-63292
Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when...
CVE-2026-79768
Path equivalence: '/./' single dot directory vulnerability in Apache HTTP Server's moduserdir module when configured with absolute non-wildcard UserDir directive the 2nd form in https://httpd.apache.org/docs/2.4/mod/moduserdir.htmluserdir This issue affects Apache HTTP Server: from 2.4.0 through...
UBUNTU-CVE-2026-56154
Use After Free vulnerability in Apache HTTP Server's modrewrite when using lookahead %LA-U:HTTP:... This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
UBUNTU-CVE-2026-63686
A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to...
UBUNTU-CVE-2026-63292
Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when...
UBUNTU-CVE-2026-56449
Out-of-bounds Write vulnerability in Apache HTTP Server's modproxyhtml with crafted HTTP response bodies. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
UBUNTU-CVE-2026-73637
Use after free in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifeti...
CVE-2026-66357
A flaw was found in the inets component of Erlang/OTP, specifically within its httpd server. This vulnerability arises from the httpd server's failure to correctly implement obs-fold obsolete line folding for HTTP header continuation lines, as defined in RFC 2616 and RFC 7230. This oversight allo...
PyJWT: PyJWKClient follows redirects when fetching JWKS
SummaryPyJWT 2.13.0 PyJWKClient followed HTTP redirects while fetching a JWKS,without validating the redirect destination. A configured trusted endpointcould therefore redirect the client to a different host. ImpactWhen an application uses PyJWKClient with caller-supplied request headers andan...
PYSEC-2026-4144 PyJWT: PyJWKClient follows redirects when fetching JWKS
Summary PyJWT 2.13.0 PyJWKClient followed HTTP redirects while fetching a JWKS, without validating the redirect destination. A configured trusted endpoint could therefore redirect the client to a different host. Impact When an application uses PyJWKClient with caller-supplied request headers and ...
PYSEC-2026-4142 PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
Package pyjwt PyPI Affected versions tested & verified on: 2.13.0. Every version whose PyJWS.load translates only ValueError is affected Description PyJWS.looad jwt/apijws.py:337 splits the compact token, base64url decodes the header segment and hands it to json.loads before verifysignature runs...
Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files
SummaryHTTPSession mounts a FileAdapter for the file:// scheme and inherits redirect handlingunchanged from requests.Session. requests does not check for scheme downgrades orcross-protocol transitions when it follows a redirect, so any https request Streamlink makes canbe redirected by the remote...
PYSEC-2026-4172 Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files
Summary HTTPSession mounts a FileAdapter for the file:// scheme and inherits redirect handling unchanged from requests.Session. requests does not check for scheme downgrades or cross-protocol transitions when it follows a redirect, so any https request Streamlink makes can be redirected by the...