CVE-2026-66357

A flaw was found in the inets component of Erlang/OTP, specifically within its httpd server. This vulnerability arises from the httpd server's failure to correctly implement obs-fold obsolete line folding for HTTP header continuation lines, as defined in RFC 2616 and RFC 7230. This oversight allo...

BIT-ENVOY-2026-73552 Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates saferegex values with RE2's UTF-8 subject semantics. A downstream client can preserve a prohibit...

obs-service-cargo-7.2.2-3.1 on GA media (moderate)

obs-service-cargo-7.2.2-3.1 on GA media Announcement ID: openSUSE-SU-2026:11861-1 Rating: moderate Cross-References: CVE-2026-93599 CVSS scores: CVE-2026-93599 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-93599 SUSE : 8.7...

OPENSUSE-SU-2026:11861-1 obs-service-cargo-7.2.2-3.1 on GA media

These are all security issues fixed in the obs-service-cargo-7.2.2-3.1 package on the GA media of openSUSE Tumbleweed...

[SECURITY] Fedora 45 Update: obs-studio-plugin-vaapi-0.4.2-7.fc45

GStreamer based VAAPI encoder implementation. Taken out of the GStreamer OBS plugin as a standalone plugin. Simply because the FFMPEG VAAPI implementation shows performance bottlenecks on some AMD hardware. Supports H.264, H.265 and AV1...

[SECURITY] Fedora 45 Update: obs-studio-plugin-pwvideo-0.2.4-3.fc45

Generic PipeWire video source for OBS. Useful for routing arbitrary video streams into your scenes...

[SECURITY] Fedora 45 Update: obs-studio-plugin-droidcam-2.4.3-7.fc45

Use your phone as a camera directly in OBS. You can add as many devices as you want, either using WiFi or USB...

[SECURITY] Fedora 45 Update: obs-studio-32.2.2-3.fc45

Open Broadcaster Software is free and open source software for video recording and live streaming...

CVE-2026-73552

Envoy HTTP RBAC safe_regex matching evaluates header values with RE2's UTF-8 subject semantics , but Envoy accepts RFC-valid obs-text (non-UTF-8) header bytes. In a negative RBAC policy (deny rule), a crafted header containing an obs-text octet causes RE2::FullMatch to return no-match, which the ...

EUVD-2026-84104

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates saferegex values with RE2's UTF-8 subject semantics. A downstream client can preserve a prohibit...

CVE-2026-73552 Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates saferegex values with RE2's UTF-8 subject semantics. A downstream client can preserve a prohibit...

CVE-2026-73552 Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates saferegex values with RE2's UTF-8 subject semantics. A downstream client can preserve a prohibit...

CVE-2026-73552 Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates saferegex values with RE2's UTF-8 subject semantics. A downstream client can preserve a prohibit...

Linux Distros Unpatched Vulnerability : CVE-2026-66357

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - httpd has never implemented obs-fold RFC 2616 2.2 / RFC 7230 3.2.4 header continuation lines. Every CRLF followed by a non-CRLF octet unconditionally starts a n...

inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation

...

CVE-2026-63385

A flaw was found in libevent. The evhttpdecodeuriinternal function in http.c decodes percent-encoded %00 bytes into literal NUL characters without rejecting them, allowing an attacker to craft a URI such as /admin/secret%00.jpg where extension-based access checks see .jpg but the server processes...

DEBIAN-CVE-2026-66357

httpd has never implemented obs-fold RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines. Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved. This issue...

AZL-98460 CVE-2026-66357 affecting package erlang for versions less than 26.2.5.21-6

httpd has never implemented obs-fold RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines. Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved. This issue...

CVE-2026-66357

httpd has never implemented obs-fold RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines. Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved. This issue...

CVE-2026-66357

httpd has never implemented obs-fold RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines. Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved. This issue...