300 matches found
CLEANSTART-2026-LJ66214 llhttp parser in the http module in Node v20
Security vulnerability affects the openjdk17 package. The llhttp parser in the http module in Node v20...
SUSE-SU-2026:4355-1 Security update for nodejs16
This update for nodejs16 fixes the following issues: - CVE-2025-23085: memory leak when remote peer abruptly closes socket without sending GOAWAY notification bsc1236250. - CVE-2025-23166: improper error handling in async cryptographic operations crashes process bsc1243218. - CVE-2025-23167:...
CVE-2026-69244
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigg...
llhttp HTTP Client Arbitrary Header Injection
The vulnerability of the HTTP message analyzer for the llhttp HTTP client and aiohttp is related to the failure to handle CRLF sequences in HTTP headers when processing the reason parameter. Exploiting this vulnerability allows an attacker to inject arbitrary HTTP headers and circumvent existing...
Node.js: HTTP Request Smuggling via Connection: close<TAB> in Node.js llhttp parser
A vulnerability was discovered in the Node.js HTTP server where it ignores the "Connection: close" header when the token is followed by a tab character. This allows an attacker to send a second request on the same connection, even after the first request should have closed the connection...
Header Injection
aiohttp is vulnerable to Header Injection. The vulnerability is due to the C parser llhttp accepting null bytes and control characters in response header values, where crafted header values containing these characters can be interpreted differently by the application or downstream proxies,...
Node.js: Improper Input Validation — HTTP Response Parser Unconditionally Accepts Bare CR in Status Line
The llhttp HTTP response parser in Node.js up to version 24.14.1 llhttp v9.3.0 and v9.3.1 was found to unconditionally accept a bare carriage return CR as a valid response status line terminator. This parsing asymmetry was present in the response path but not in the request parsing, enabling...
GHSA-63HF-3VF5-4WQF AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass
Summary The C parser the default for most installs accepted null bytes and control characters in request headers. Impact An attacker could send header values that are interpreted differently than expected due to the presence of control characters. For example, request.url.origin may return a...
HTTP Response Splitting
Overview Affected versions of this package are vulnerable to HTTP Response Splitting in the llhttp component. An attacker can manipulate HTTP response headers by injecting null bytes or control characters, causing headers to be interpreted differently by various components, which may lead to...
CVE-2026-34520
The aiohttp asynchronous HTTP client/server framework for Python and asyncio is vulnerable to a security bypass and header injection due to a flaw in its C parser (the default for most installations). Specifically, the parser accepts null bytes and control characters in response headers, allowing...
TencentOS Server 3: nodejs:20 (TSSA-2025:0462)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0462 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...
EUVD-2021-10084
Malware in sbrugna...
EUVD-2021-10085
Malware in sbrugna...
EUVD-2025-27706
Malicious code in bioql PyPI...
EUVD-2022-38147
Malicious code in bioql PyPI...
EUVD-2023-2033
Malicious code in bioql PyPI...
CVE-2022-35256 vulnerabilities
Vulnerabilities for packages: py3-llhttp...
GHSA-RC2M-Q589-VPQX vulnerabilities
Vulnerabilities for packages: py3-llhttp...
