CVE-2026-66754-Remote-Denial-of-Service-via-Reachable-Assertion-in-URL-Prefix-Handling-rouille-

Advisory di sicurezza: Denial of Service remoto tramite assert raggiungibile nella gestione dei prefissi URL rouille ID CVE assegnato: CVE-2026-66754 Sommario Request::removeprefix verifica l'URL percent-decodificato ma esegue l'assert su quello grezzo. Una richiesta il cui percorso decodificato...

CVE-2026-66746-HTTP-Response-Splitting-via-Unvalidated-Response-Header-Values-rouille-

Advisory di Sicurezza: HTTP Response Splitting tramite Valori di Header di Risposta Non Validati rouille ID CVE assegnato: CVE-2026-66746 Riepilogo rouille scrive i valori degli header di risposta al client senza verificarne la presenza di carriage return o line feed. Un'applicazione che inserisc...

CVE-2014-0094

CVE-2014-0094 Para verificação. Referência: https://piyolog.hatenadiary.jp/entry/20140417/1397750197, vulhub/java:7u55-jdk tomcat-8.0.5 struts-2.3.16 reproduzir. O classLoader está funcionando, mas o log crucial está percent-encoded, então não chega até RCE Também adicionei a versão Windows embor...

CVE-2024-38819-POC2

CVE-2024-38819: प्रूफ ऑफ कॉन्सेप्ट PoC यह CVE-2024-38819 भेद्यता के लिए एक प्रूफ ऑफ कॉन्सेप्ट है, जिसे मैंने रिपोर्ट किया था, जो पाथ ट्रैवर्सल एक्सप्लॉइट को प्रदर्शित करता है। निष्पादन चरण 1. Docker इमेज बनाएँ Spring Boot 3.3.4, जो Spring Framework 6.1.13 पर आधारित है root@kitploit: cd vuln docke...

CVE-2021-41773-POC

CVE-2021-41773 Rapporto di riproduzione della vulnerabilità Panoramica della vulnerabilità CVE ID : CVE-2021-41773 Nome vulnerabilità : Vulnerabilità di path traversal in Apache HTTP Server Livello di rischio : Alto CVSS 7.5 Versioni interessate : Apache HTTP Server 2.4.49 Descrizione vulnerabili...

CVE-2026-76842

CVE-2026-76842 affects the Mercado Pago Node.js SDK (through 3.4.0 ). The payment, paymentRefund, advancedPayment, and disbursementRefund clients interpolate caller-supplied identifiers into API request paths via template literals without percent-encoding , so URL-structural characters (dot-dot, ...

CVE-2026-76172

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries...

CVE-2026-75899

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

CVE-2026-76172 fast-uri vulnerable to host confusion via percent-encoded scheme normalization

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries...

EUVD-2026-64763

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

CVE-2026-75899

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

CVE-2026-75899 fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

CVE-2026-75899

fast-uri , a URI parser for Node.js, suffers from double percent-decoding of the hostname: it decodes percent escapes during parsing and decodes them again during authority recomposition. This violates RFC 3986 §2.4 (an implementation must not decode the same string more than once) and allows a s...

Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

Summary The cross-site WebSocket hijacking fix was reimplemented as an origin check gated on a raw-URI prefix test, but Go's ServeMux routes on the percent-decoded path, so requesting /%61pi/events reaches the WebSocket handler while skipping the only origin control, and the upgrader itself accep...

EUVD-2026-63668

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures...

CVE-2026-67448 Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures...

CVE-2026-67448 Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures...

CVE-2026-73259

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MGENABLEDIRLIST and persuade a user to visit it. The mghttpservedir and listdir path in src/http.c places the decoded request URI into the...

OSEC-2026-16 Path traversal in Cohttp.Path.resolve_local_file

The issue is that the function normalizes the URI path before percent decoding it: OCaml let resolvelocalfile docroot uri = let path = Uri.pctdecode path resolve "http" ofstring "/" uri in ... Because %2f is decoded after Uri.resolve, encoded separators survive dot-segment normalization. For...

CVE-2026-63385

Libevent versions before 2.1.13 and 2.2.2-alpha contain two HTTP parsing flaws in http.c: evhttp_decode_uri_internal decodes %00 into literal NUL bytes, truncating paths to bypass validation; evhttp_header_is_valid_value accepts obsolete line folding with CRLF, enabling header injection and acces...