25345 matches found
CVE-2026-73812
Erlang/OTP inets (HTTP server module) is vulnerable to HTTP Request Smuggling (CL.TE desync) when deployed behind a Content-Length-preferring front-end proxy. The root cause is in httpd:check_header/3 , which rejects duplicate Content-Length headers but never validates the simultaneous presence o...
EUVD-2026-69235
httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...
CVE-2026-73812 inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...
CVE-2026-73812 inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...
CVE-2026-73812 inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...
EEF-CVE-2026-73812 inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
Summary httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired...
CVE-2026-71380 httpd applies no timeout while receiving a request body, parking a worker on a stalled client
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...
CVE-2026-71380
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...
Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Request Smuggling.
Summary undici is used by IBM Storage Fusion Data Foundation, which could cause Request Smuggling. CVE-2026-1525, CVE-2026-1526, CVE-2026-1527, CVE-2026-1528, CVE-2026-2229. Vulnerability Details CVEID:CVE-2026-1525 DESCRIPTION: Undici allows duplicate HTTP Content-Length headers when they are...
CVE-2026-71562
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...
CVE-2026-71562
Erlang/OTP inets httpc contains an improper validation flaw where server-supplied Content-Length and Retry-After header values are converted via unbounded list_to_integer/1 before size checks can apply. A malicious HTTP server can return a numeric header with up to roughly 1.26 million digits , c...
CVE-2026-71562 httpc does not bound server-supplied numeric header values before integer conversion
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...
CVE-2026-71562 httpc does not bound server-supplied numeric header values before integer conversion
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...
CVE-2026-71562 httpc does not bound server-supplied numeric header values before integer conversion
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...
CVE-2026-9637
A denial-of-service security issue exists in the affected Logix platforms listed in the table above. The security issue stems from improper validation of input length during CIP message processing. This can result in a major nonrecoverable fault MNRF, requiring a power cycle to recover...
CVE-2026-9624
A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet can cause the RSLinx® Classic service to crash due to insufficient data length validation, requiring a restart of the service to recover...
CVE-2026-9624 RSLinx Classic® - Multiple Vulnerabilities
A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet can cause the RSLinx® Classic service to crash due to insufficient data length validation, requiring a restart of the service to recover...
CVE-2026-9624
CVE-2026-9624 is a denial-of-service vulnerability in Rockwell Automation's RSLinx® Classic . A crafted CIP packet with insufficient data length validation can crash the RSLinx® Classic service, requiring a manual restart to recover. The vulnerability is network-reachable with low attack complexi...
EUVD-2026-69140
A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet can cause the RSLinx® Classic service to crash due to insufficient data length validation, requiring a restart of the service to recover...
CVE-2026-9624 RSLinx Classic® - Multiple Vulnerabilities
A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet can cause the RSLinx® Classic service to crash due to insufficient data length validation, requiring a restart of the service to recover...