CVE-2026-113728

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An...

A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect

Impact. A malicious or compromised A2A agent can cause the client's API key credential to be forwarded to an arbitrary third-party server. The agent serves an AgentCard with an APIKeySecurityScheme specifying a custom header name, then responds with an HTTP redirect. The JDK HttpClient follows th...

GHSA-9RHM-2H4X-JWMX A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect

Impact. A malicious or compromised A2A agent can cause the client's API key credential to be forwarded to an arbitrary third-party server. The agent serves an AgentCard with an APIKeySecurityScheme specifying a custom header name, then responds with an HTTP redirect. The JDK HttpClient follows th...

GO-2026-6776 vulnerabilities

Vulnerabilities for packages: kserve-localmodelnode-agent, kserve, keda-http-add-on-fips, kserve-localmodelnode-agent-fips, kserve-fips, keda-http-add-on, k8sgpt...

CLSA-2026-1792529052 TuxCare security update for symfony/http-foundation (1 CVE)

TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in 4.4.49-p3+tuxcare...

net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections

A flaw was found in Go's net/http package. When an HTTP CONNECT request with a request body is rejected by a server, the client transport can desynchronize the connection before returning it to the shared idle pool. In shared reverse proxy environments, a remote attacker can exploit this issue to...

net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers

A flaw was found in Go's net/http package. When operating as a reverse proxy, the HTTP/2 implementation does not properly validate framing-related headers in responses received from upstream servers before forwarding them to downstream HTTP/1 clients. A malicious upstream server can exploit this...

net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames

A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service DoS by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration SETTINGS frames that...

net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server

A flaw was found in Go's HTTP/2 server implementation. A remote attacker can bypass connection-level flow control limits—mechanisms that regulate incoming network data—potentially causing excessive memory consumption and a Denial of Service DoS. This issue occurs because the server improperly...

net/http: golang: golang: Denial of Service via crafted HTTP Range headers

A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service DoS by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU...

net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses

A flaw was found in Go's net/http package. When an HTTP server sends a successful response to an HTTP/1 CONNECT request without taking raw control of the connection, it improperly continues to process incoming data as standard HTTP requests instead of establishing a tunnel. A remote attacker can...

net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification

A flaw was found in Go's net/http package. A remote attacker can cause a Denial of Service DoS by crashing the HTTP/2 server. Due to missing synchronization, the server concurrently modifies its HPACK HTTP/2 header compression encoder when encoding response headers while processing incoming table...

Important: Red Hat Security Advisory: golang security, bug fix, and enhancement update

An update for golang is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion

A flaw was found in the Go net/http package. A remote attacker can trigger a Denial of Service DoS by sending HTTP/2 requests that declare an excessive number of trailer header fields. Because the server bypasses configured header limits when allocating memory for these declarations, an attacker...

CVE-2026-94265

When processing an HTTP redirect to a URL containing userinfo a username:password component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl t...

CVE-2026-94265 Authorization: Negotiate sent to foreign origin

When processing an HTTP redirect to a URL containing userinfo a username:password component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl t...

CVE-2026-94265 Authorization: Negotiate sent to foreign origin

When processing an HTTP redirect to a URL containing userinfo a username:password component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl t...

EUVD-2026-105353

When processing an HTTP redirect to a URL containing userinfo a username:password component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl t...

CVE-2026-94265

The curl tool is vulnerable to a flaw where it may erroneously retain and re-transmit HTTP Negotiate authentication states when processing an HTTP redirect to a URL containing userinfo (a username:password component). This allows a malicious server to trigger a redirect with arbitrary userinfo, f...

CVE-2026-94265

When processing an HTTP redirect to a URL containing userinfo a username:password component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl t...