CVE-2026-69210

Http4s , a Scala HTTP service library, is vulnerable to a denial of service via its WebSocket decoder. In versions prior to 0.23.35 and 1.0.0-M47 , FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAX_VALUE but incorrectly permits negative 64-bit lengths . A remote client...

EUVD-2026-79192

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAXVALUE but permits negative 64-bit lengths. A remote client that completes a WebSocket handshake through an Ember server can send su...

CVE-2026-69210 Http4s: WebSocket decoder accepts negative length, causing infinite decode loop

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAXVALUE but permits negative 64-bit lengths. A remote client that completes a WebSocket handshake through an Ember server can send su...

CVE-2026-69204

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rules. When ember-server is behind a keep-alive intermediary...

CVE-2026-69204

CVE-2026-69204 affects Http4s , a Scala HTTP library, specifically the Ember HTTP/1.1 implementation. The root cause is that Ember does not reject messages containing both Transfer-Encoding and Content-Length headers, allowing an intermediary and Ember to select different body framing rules. This...

EUVD-2026-79025

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rules. When ember-server is behind a keep-alive intermediary...

CVE-2026-69204 Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rules. When ember-server is behind a keep-alive intermediary...

CVE-2026-69204 Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rules. When ember-server is behind a keep-alive intermediary...

CVE-2026-69204 Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rules. When ember-server is behind a keep-alive intermediary...

CVE-2026-58483

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, weburlread in src/index.ts passes a caller-supplied URL to readUrlContent in src/url-reader.ts, where checkContentLength treats a missing Content-Length...

CVE-2026-58483 mcp-searxng: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, weburlread in src/index.ts passes a caller-supplied URL to readUrlContent in src/url-reader.ts, where checkContentLength treats a missing Content-Length...

CVE-2026-58483 mcp-searxng: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, weburlread in src/index.ts passes a caller-supplied URL to readUrlContent in src/url-reader.ts, where checkContentLength treats a missing Content-Length...

CVE-2026-58483

mcp-searxng , a Model Context Protocol server for SearXNG integration, is vulnerable to denial of service in versions prior to 1.7.1 . The web_url_read function in src/index.ts passes a caller-supplied URL to readUrlContent() in src/url-reader.ts, where checkContentLength() treats a missing Conte...

EUVD-2026-79124

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, weburlread in src/index.ts passes a caller-supplied URL to readUrlContent in src/url-reader.ts, where checkContentLength treats a missing Content-Length...

CVE-2026-58483 mcp-searxng: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, weburlread in src/index.ts passes a caller-supplied URL to readUrlContent in src/url-reader.ts, where checkContentLength treats a missing Content-Length...

DEBIAN-CVE-2023-54397

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain...

CVE-2023-54397

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain...

UBUNTU-CVE-2026-91945

FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in smartcard response decoders that fail to validate ATR length fields against fixed inline arrays. Authenticated RDP clients can send oversized ATR lengths in PAKIDCOREDEVICEIOCOMPLETION responses to trigger reads past...

CVE-2026-91959

FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rtsreadresult function within the RPC gateway transport parser. Attackers can send a malicious BINDACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort...

CVE-2026-91945

FreeRDP versions before 3.31.0 are affected by an out-of-bounds read in smartcard response decoders that fail to validate ATR (Answer to Reset) length fields against fixed inline arrays. An authenticated RDP client can send oversized ATR lengths in PAKID_CORE_DEVICE_IOCOMPLETION responses, trigge...