httpd parks a request worker indefinitely on a malformed chunk size sent after the headers

...

CVE-2026-69664

Erlang/OTP inets httpd contains a Missing Release of Resource after Effective Lifetime flaw that allows an unauthenticated remote attacker to cause denial of service. The root cause is in how httpd_request_handler:handle_info/2 handles a malformed chunk-size line arriving in a separate write from...

EEF-CVE-2026-69664 httpd parks a request worker indefinitely on a malformed chunk size sent after the headers

Summary Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection i...

AZL-76700 CVE-2026-1801 affecting package libsoup for versions less than 3.4.4-12

A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soupfilterinputstreamreadline logic, where libsoup accepts malformed chunk headers, such as lone line feed LF characters instead of the required...

EUVD-2026-5176

A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soupfilterinputstreamreadline logic, where libsoup accepts malformed chunk headers, such as lone line feed LF characters instead of the required...

CVE-2026-1801

CVE-2026-1801 affects libsoup. The vulnerability stems from non-RFC-compliant parsing in soup_filter_input_stream_read_line(), allowing malformed chunk headers (for example, lone LF instead of CRLF) to enable HTTP Request Smuggling. A remote attacker can trigger this without authentication by sen...

CVE-2026-1801 Libsoup: libsoup: http request smuggling via malformed chunk headers

A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soupfilterinputstreamreadline logic, where libsoup accepts malformed chunk headers, such as lone line feed LF characters instead of the required...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000749)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000749 advisory. The SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service system crash via a malformed ASCONF chunk, related to...

SUSE CVE-2014-0075

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service resource consumption via a malformed chunk size in chunke...

GHSA-475F-74WP-PQV5 Integer Overflow or Wraparound in Apache Tomcat

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service resource consumption via a malformed chunk size in chunke...

CVE-2017-6192

Buffer overflow in APNGDis 2.8 and earlier allows a remote attackers to cause denial of service and possibly execute arbitrary code via a crafted image containing a malformed chunk size descriptor...

CVE-2017-6192

The CVE-2017-6192 entry concerns APNGDis 2.8 and earlier. Affected component: APNGDis (image processing). Root cause: buffer overflow triggered by processing a crafted image with a malformed chunk size descriptor, leading to potential denial of service and possibly arbitrary code execution. Explo...

Integer overflow

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service resource consumption via a malformed chunk size in chunke...

CVE-2014-0075

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service resource consumption via a malformed chunk size in chunke...

UBUNTU-CVE-2014-0075

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service resource consumption via a malformed chunk size in chunke...

Security fix for the ALT Linux 6 package libpng version 1.2.13-alt3

May 16, 2007 Dmitry V. Levin 1.2.13-alt3 - Imported upstream fix for pnghandletRNS bug CVE-2007-2445: a grayscale PNG image with a malformed tRNS chunk may crash some libpng applications...