CVE-2026-93003

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing...

CVE-2026-93003 NetX Duo Web HTTP server interprets request body content as HTTP header fields

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing...

CVE-2026-93003

The NetX Duo Web HTTP server contains a vulnerability where the HTTP server searches the entire request packet for header fields rather than stopping at the end of the header section. This allows a header field name placed within the request body to be incorrectly reported as a header. Consequent...

CVE-2026-93003 NetX Duo Web HTTP server interprets request body content as HTTP header fields

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing...

EUVD-2026-105153

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing...

CVE-2026-93003 NetX Duo Web HTTP server interprets request body content as HTTP header fields

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing...

PT-2026-118488

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing...

Eclipse ThreadX – NetX Duo input validation vulnerability

Eclipse ThreadX – NetX Duo 6.5.1.202602 and earlier versions have a vulnerability related to input validation errors. This vulnerability arises because the HTTP server of Web Add-ons scans the entire request packet during the search for header fields, rather than stopping at the end of the header...

GHSA-8H4C-X2WG-6XP8 Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

Summary Ember's HTTP/1.1 request parser does not reject a message that carries both a Transfer-Encoding and a Content-Length header. RFC 9112 §6.1 requires a server to treat such a message as a framing error and close the connection. An intermediary that follows the RFC's CL-strip-and-forward pat...

EUVD-2026-33941

mint: Content-Length header accepts non-RFC "+" sign prefix...

CVE-2026-2835: Inconsistent Interpretation of HTTP Requests

An HTTP Request Smuggling vulnerability CWE-444 has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to improperly allowing HTTP/1.0 request bodies to be close-delimited and incorrect handling of multiple Transfer-Encoding values, allowing attackers...