CLEANSTART-2026-GY77159 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

CVE-2026-78659 affects multiple packages. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request. See references for individual vulnerability details...

CLEANSTART-2026-CO30211 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability...

CLEANSTART-2026-QI90513 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

CVE-2026-97032 affects multiple packages. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. See references for individual vulnerability details...

CLEANSTART-2026-BA60559 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne...

CVE-2026-94439 affects multiple packages. When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. See references for individual vulnerability details...

CLEANSTART-2026-IE92648 client may issue specially crafted HTTP/1

Security vulnerability affects the solr package. A client may issue specially crafted HTTP/1...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unsupported HTTP methods on static paths

A flaw was found in kin-openapi. An unauthenticated remote attacker can cause a Denial of Service DoS by sending requests with unsupported or non-canonical HTTP methods to an existing static path. Because the application encounters an unhandled panic before authentication is evaluated, these...

Security Bulletin: IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server and libexpat

Summary IBM HTTP Server used by IBM WebSphere Application Server is affected by multiple vulnerabilities due to libexpat and the included Apache HTTP Server. Vulnerability Details CVEID:CVE-2026-66046 DESCRIPTION: Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic...

PT-2026-114355

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description A flaw exists in the ngx http v3 module module. When HTTP/3 is used in conjunction with the proxy request buffering directive set to on, a...

CVE-2026-103930: Improper Neutralization of CRLF Sequences in HTTP Headers

cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::openstream in httplib.h accepts a caller-controlled path that reaches detail::writerequestline without the detail::encodepath protection used by the ordinary buffered request path. Raw carriage-return and...

CVE-2026-76083: Server-Side Request Forgery (SSRF)

Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/queryrunner/jsonds.py used getallresults to combine its configured baseurl with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured...

CVE-2026-59951: Uncontrolled Resource Consumption

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamablehttpapp, and StreamableHTTPSessionManager, retain session entries without an id...

CVE-2026-92392: Use After Free

During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object...

CVE-2026-91881: Improper Certificate Validation

Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized...

PT-2026-114149

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.31.0 Description An HTTP header injection issue exists in the proxy component. This occurs because a lone Line Feed LF character within the target portion of a routing token, specifically in the Cookie: msts=...

CVE-2026-108395: Allocation of Resources Without Limits or Throttling

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

libwasmtime -- Multiple vulnerabilities

Wasmtime development team reports: Out-of-bounds zero-length stream writes can panic. Host panic when component callasync is cancelled under some conditions. Panic on erroneous call-to-host from guest realloc call. Yielding in a component start function can lead to a host panic. Panic when invoki...

Quarkus Java Framework Data Compromise

The vulnerability of the Quarkus framework is related to incorrect interpretation of HTTP requests. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and integrity of the protected information...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130123)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130123 advisory. Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through...

Linux Distros Unpatched Vulnerability : CVE-2026-93582

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The HTTP Basic Authentication modules in OTRS Community Edition 6 and prior accept the authenticated username from either the REMOTEUSER or HTTPREMOTEUSER...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: rabbitmq-server (UTSA-2026-130063)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130063 advisory. RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service DoS...