149483 matches found
EUVD-2026-102160
kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from...
CVE-2026-100351 kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from...
CVE-2026-98430
A flaw was found in the Linux kernel's Elastic Fabric Adapter EFA driver. The driver enables interrupt request IRQ handling before initializing its administrative queues and frees those queues before disabling the interrupt handler. If an interrupt occurs while the queues are uninitialized or...
SUSE CVE-2026-61642
Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing src/HttpHeader.cc accepted the bare Transfer-Encoding: identity...
io.netty/netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass Transfer-Encoding header validation by splitting the Transfer-Encoding field across multiple headers, with the last field containing a non-final transfer coding like gzip or deflate. This bypass ca...
io.netty/netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling
A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls ...
No title provided
A flaw was found in Netty. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending numerous pipelined HTTP/1.1 requests over a single connection while withholding reads. Netty's HTTP server codec stores unanswered requests in an internal queue...
io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority
A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...
io.netty/netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing
A flaw was found in Netty's netty-codec-http component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an...
io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can le...
io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough)
A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...
Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty
Summary IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2024-29025 DESCRIPTION: Netty is an asynchronous event-driven network application framework for rapid development of maintainable...
AZL-108246 CVE-2026-98432 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period tcpv4synrecvsock transfers ownership of ireq-ireqopt to the child socket newinet-inetopt without copying it. Another cpu can concurrently process a retransmitted SYN for th...
DEBIAN-CVE-2026-98432
In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period tcpv4synrecvsock transfers ownership of ireq-ireqopt to the child socket newinet-inetopt without copying it. Another cpu can concurrently process a retransmitted SYN for th...
CVE-2026-110724
In api-gateway versions till 1.7.3, The default rate-limit key resolver, ClientIpKeyResolver, derives the per-client bucket key from the leftmost element of the X-Forwarded-For request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy...
EUVD-2026-102025
In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period tcpv4synrecvsock transfers ownership of ireq-ireqopt to the child socket newinet-inetopt without copying it. Another cpu can concurrently process a retransmitted SYN for th...
CVE-2026-110726
In api-gateway versions till 1.7.3, The default rate-limit key resolver, ClientIpKeyResolver, derives the per-client bucket key from the leftmost element of the X-Forwarded-For request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy...
Authentication Bypass Using an Alternate Path or Channel
Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the EthereumAuthenticator process. An attacker can gain unauthorized access to protected resources by crafting a request path that includes the configured login path as a later...
Authentication Bypass Using an Alternate Path or Channel
Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the EthereumAuthenticator process. An attacker can gain unauthorized access to protected resources by crafting a request path that includes the configured login path as a later...
PYSEC-2026-4317 wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding
Summary The trainerlogin view in wger accepts GET requests and executes djangologin without any CSRF protection, because Django's CsrfViewMiddleware only enforces tokens on unsafe methods POST/PUT/PATCH/DELETE. An attacker can embed a single tag on a malicious page; when an authenticated trainer...