LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint

Summary A path traversal vulnerability in eKuiper's administrative management endpoints allows privileged users or attackers with access to management APIs to delete arbitrary files or directories on the host system. Details In internal/plugin/native/manager.go, the plugin installation endpoint...

GHSA-PQQC-8V73-9GG2 LF Edge eKuiper: SSRF in External Service

Summary Server-side request forgery SSRF vulnerability in eKuiper allows an attacker with permissions to register external services or create rules to induce the eKuiper server to make requests to unintended network locations, such as internal services, loopback interfaces localhost, or cloud...

GHSA-G8RH-FJM6-H2H9 LF Edge eKuiper: Self-XSS in External Service Creation

Summary A Cross-Site Scripting XSS vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces. Details Prior to v2.4.0, external servic...

Linux Distros Unpatched Vulnerability : CVE-2026-19203

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request...

EUVD-2026-70246

HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers...

CVE-2026-19203

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

DEBIAN-CVE-2026-19203

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

HTTP Request Smuggling

Overview org.eclipse.jetty:jetty-http is an is a http module for jetty server. Affected versions of this package are vulnerable to HTTP Request Smuggling in the chunked request parsing of HttpParser, which accepts a lone LF, rather than CRLF, as the line terminator for chunk extensions, chunk dat...

CVE-2026-19203

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

EUVD-2026-72718

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

CVE-2026-19203

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

CVE-2026-19203

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

CVE-2026-19203

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

CVE-2026-19203

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

CVE-2026-19203

Eclipse Jetty is vulnerable to HTTP request smuggling due to acceptance of a lone LF character as a terminator in HTTP/1.1 chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, the misinterpretation may occur in chunk extensions, chunk data termination, or t...

PT-2026-87042

Name of the Vulnerable Software and Affected Versions Jetty affected versions not specified Description An issue exists where a client can send specially crafted HTTP/1.1 chunked requests that cause the server and an intermediary proxy to interpret request boundaries differently, potentially...

CVE-2026-19203: Inconsistent Interpretation of HTTP Requests

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

SUSE CVE-2026-84379

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates attacker-controlled contenttype values and custom headers from the files= three-element filename, content, contenttype tuple and the files=...

Linux Distros Unpatched Vulnerability : CVE-2026-84379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates...

CVE-2026-84379

A flaw was found in HTTPX2, a Python HTTP client. A remote attacker could exploit this vulnerability by sending specially crafted multipart/form-data requests. The FileField.renderheaders function fails to validate Content-Type values and custom headers, allowing the injection of Carriage Return ...