CVE-2026-20896-Gitea-Authentication-Bypass

CVE-2026-20896 - Gitea ≤1.26.2 인증 우회 1. Gitea란 무엇인가? Gitea는 조직과 개발자가 소스 코드 저장소를 관리하고, 이슈를 추적하고, 변경 사항을 검토하며, 소프트웨어 프로젝트에서 협업할 수 있게 해주는 경량 오픈소스 Git 호스팅 플랫폼 입니다. GitHub 및 GitLab 과 같은 플랫폼과 유사한 기능을 제공하지만 자체 호스팅이 가능하고 효율적이며 유지 관리가 쉬운 것이 특징으로, 코드와 개발 인프라에 대한 더 큰 통제권을 원하는 조직에 적합합니다. 2. 취약점 설명...

CVE-2026-63379

A flaw was found in Libevent, an event notification library. An unauthenticated remote attacker can exploit a vulnerability where chunked HTTP Hypertext Transfer Protocol trailers are incorrectly merged into request headers. This allows the attacker to place security-sensitive fields in trailers,...

AZL-96941 CVE-2026-63379 affecting package libevent for versions less than 2.1.13-1

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttpreadtrailer and merges them into request headers. The fix introduces evhttpparseheadersimpl and a temporary trailer header list. An unauthenticated remote...

CVE-2026-63379 Libevent: HTTP Header smuggling

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttpreadtrailer and merges them into request headers. The fix introduces evhttpparseheadersimpl and a temporary trailer header list. An unauthenticated remote...

EUVD-2026-63562

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttpreadtrailer and merges them into request headers. The fix introduces evhttpparseheadersimpl and a temporary trailer header list. An unauthenticated remote...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection via the encodeV1. An attacker can inject arbitrary CRLF sequences into AFUNIX addresses by supplying specially crafted input, resulting in the creation of multiple PROXY protocol header lines. This can lead to client IP...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the ForwardAuth middleware when trustForwardHeader is set to false and the deployment is behind a trusted upstream proxy. An attacker can gain unauthorized access to protected backend...

CVE-2026-32881

Summary: CVE-2026-32881 affects the Gleam web server “ewe.” Versions 0.6.0–3.0.4 are vulnerable to an authentication bypass and header spoofing due to how trailer headers are merged into req.headers after body parsing. The denylist in the trailer handling only blocks nine header names, allowing a...

Emby Server Proxy Header Spoofing Vulnerability (GHSA-fffj-6fr6-3fgf)

Emby Server is prone to a proxy header spoofing vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:emby:emby.releases...