CLEANSTART-2026-PH12494 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

CVE-2026-78659 affects multiple packages. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request. See references for individual vulnerability details...

CLEANSTART-2026-UX80273 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

CVE-2026-78660 affects multiple packages. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. See references for individual vulnerability details...

CLEANSTART-2026-DW61297 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability...

EUVD-2026-98176

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application...

EUVD-2026-97981

A security flaw has been discovered in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/formUrlb of the component HTTP Blocking Page. Performing a manipulation results in cross site scripting. The attack is possible to be carried out remotely...

CVE-2026-96119

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application...

Red Hat: CVE-2026-61642: squid: squid: Request Smuggling in HTTP Transfer-Encoding

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing src/HttpHeader.cc accepted the bare Transfer-Encoding: identity...

PT-2026-111782

Name of the Vulnerable Software and Affected Versions FortiSandbox versions 5.2.0 through 5.2.1 FortiSandbox versions 5.0.0 through 5.0.6 FortiSandbox version 4.4 FortiSandbox Cloud versions 5.2.0 through 5.2.1 FortiSandbox Cloud versions 5.0.0 through 5.0.6 FortiSandbox Cloud version 4.4...

PT-2026-111785

Name of the Vulnerable Software and Affected Versions FortiSIEM version 7.5.0 Description A missing authorization issue allows an attacker to execute unauthorized code or commands by sending specially crafted HTTP requests. Recommendations At the moment, there is no information about a newer...

PT-2026-111778

Name of the Vulnerable Software and Affected Versions Fortinet FortiMail versions 7.6.0 through 7.6.3 Fortinet FortiMail versions 7.4.0 through 7.4.5 Fortinet FortiMail versions 7.2.0 through 7.2.8 Description An SQL Injection issue exists where improper neutralization of special elements used in...

PT-2026-122255

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing src/HttpHeader.cc accepted the bare Transfer-Encoding: identity...

PT-2026-111347

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A...

Tanchun: Robust Flow-Based HTTP(S) DDoS Detection Via Behavioral Attribute Guidance

HTTPS DDoS attacks have surged in frequency and scale, posing a significant threat to network security. Flow-based detection is a promising solution for large-scale HTTPS DDoS detection due to its decryption-free operation and scalability. However, the coarse-grained numerical statistics in flow...

PT-2026-111392

Name of the Vulnerable Software and Affected Versions .NET Client Library for SIMATIC S7 Webserver API versions prior to V3.3.62 Description Applications using the library do not properly redact PLC restore passwords from HTTP error exception messages. An attacker with access to logs or diagnosti...

Apache HTTP Server mod_vhost_alias() Code Execution

The vulnerability of the modvhostalias function in the Apache HTTP Server is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure or execute arbitrary code by sending a specially crafted HTTP...

ReactPHP react/http DoS

The vulnerability of the handleData function in the ReactPHP library’s react/http package, which handles streaming HTTP messages, is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

CVE-2026-109760: Protection Mechanism Failure

Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

UBUNTU-CVE-2026-70188

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-88092: Inconsistent Interpretation of HTTP Requests

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

Microsoft ASP.NET: CVE-2026-88092: ASP.NET Core Tampering Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...