154 matches found
USN-8382-1 exim4 vulnerabilities
Timo Longin discovered that Exim incorrectly handled certain SMTP messages in PIPELINING/CHUNKING configurations. A remote attacker could possibly use this issue to perform SMTP smuggling. This issue only affected Ubuntu 14.04 LTS. CVE-2023-51766 It was discovered that Exim incorrectly handled...
CVE-2026-42585
A flaw was found in Netty. This vulnerability allows a remote attacker to perform request smuggling attacks due to incorrect parsing of malformed Transfer-Encoding headers. By exploiting this flaw, an attacker can bypass security controls and potentially access sensitive information or manipulate...
EUVD-2026-32542
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-gitโs decoded representation may expose...
CLSA-2026-1778828497 tar: Fix of CVE-2023-39804
CVE-2023-39804: fix crash on PAX archive with malformed extended header attributes in locatehandler and xattrdecoder...
tar: Fix of CVE-2019-9923
CVE-2019-9923: fix NULL pointer dereference in paxdecodeheader on malformed PAX extended headers...
USN-8228-1: Exim vulnerabilities
It was discovered that Exim incorrectly handled parsing malformed JSON in message headers. A remote attacker could possibly use this issue to execute arbitrary code. CVE-2026-40685 It was discovered that Exim incorrectly handled processing of UTF-8 trailing characters. A remote attacker could...
Astra Linux - ััะทะฒะธะผะพััั ะฒ tar
In the sparse.c file of GNU Tar, before version 1.32, there was a NULL pointer dereferencing issue when parsing certain archives that contained malformed extended headers...
CLSA-2026-1777563191 tar: Fix of CVE-2019-9923
CVE-2019-9923: fix NULL pointer dereference in paxdecodeheader on malformed PAX extended headers...
Exim ็ผๅฒๅบ้่ฏฏๆผๆด
Exim is an open-source message transfer agent MTA developed by Exim Software, running on Unix systems. It primarily handles the routing, forwarding, and delivery of emails. Versions of Exim prior to 4.99.2 contained a buffer error vulnerability. This vulnerability stemmed from the utf8 operatorโs...
GHSA-26PP-8WGV-HJVM Hono missing validation of cookie name on write path in setCookie()
Summary Cookie names are not validated on the write path when using setCookie, serialize, or serializeSigned to generate Set-Cookie headers. While certain cookie attributes such as domain and path are validated, the cookie name itself may contain invalid characters. This results in inconsistent...
CVE-2026-28369
Undertow contains a flaw where the first header line starting with spaces is processed incorrectly (spaces stripped), violating HTTP standards and enabling remote request smuggling. This could allow bypassing security controls and exposing restricted data or manipulating caches. CVSSv3.1 base sco...
CVE-2026-28369 Undertow: undertow: request smuggling via malformed http request headers
A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform...
undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without...
CVE-2025-69649
A flaw was found in binutils. Processing a specially crafted ELF binary file containing malformed header fields with the readelf program can trigger a NULL pointer dereference, causing a crash and resulting in a denial of service. Mitigation To mitigate this vulnerability, do not process untruste...
UBUNTU-CVE-2025-69649
GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into displayrelocations, resulting in a segmentation fault SIGSEGV and...
CVE-2026-3419
CVE-2026-3419 (Fastify) : A flaw allows RFC-invalid Content-Type headers with trailing characters to bypass validation and reach content-type parsers, potentially causing misinterpretation of requests. This affects Fastify's handling of Content-Type header parsing, including regex-based parsers, ...
CVE-2026-3419 Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation
Fastify incorrectly accepts malformed Content-Type headers containing trailing characters after the subtype token, in violation of RFC 9110 ยง8.3.1https://httpwg.org/specs/rfc9110.htmlfield.content-type. For example, a request sent with Content-Type: application/json garbage passes validation and ...
CVE-2025-69649
GNU Binutils up to 2.46 readelf contains a null pointer dereference vulnerability during relocation processing of crafted ELF headers; an invalid or null section pointer passed to display_relocations() can cause a segmentation fault. No evidence of memory corruption beyond the null pointer derefe...
CLSA-2026-1772444161 python2: Fix of 2 CVEs
CVE-2026-1299: raise exceptions for malformed input to prevent processing invalid or dangerous headers - CVE-2024-6923: encode newlines in headers and verify headers are sound...
CLSA-2026-1772192033 python2: Fix of 2 CVEs
CVE-2026-1299: raise exceptions for malformed input to prevent processing invalid or dangerous headers - CVE-2024-6923: encode newlines in headers and verify headers are sound...