150498 matches found
AZL-98478 CVE-2026-71380 affecting package erlang for versions less than 26.2.5.21-6
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...
CVE-2026-66357
httpd has never implemented obs-fold RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines. Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved. This issue...
DEBIAN-CVE-2026-66357
httpd has never implemented obs-fold RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines. Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved. This issue...
CVE-2026-74835
The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4...
UBUNTU-CVE-2026-73276
Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7,...
CVE-2026-73812
httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...
UBUNTU-CVE-2026-66357
httpd has never implemented obs-fold RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines. Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved. This issue...
CVE-2026-73276
Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7,...
UBUNTU-CVE-2026-73812
httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...
UBUNTU-CVE-2026-71380
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...
UBUNTU-CVE-2026-74835
The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4...
CVE-2026-66357
httpd has never implemented obs-fold RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines. Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved. This issue...
EUVD-2026-69283
Cross-Site request forgery CSRF vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Cross Site Request Forgery. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...
CVE-2026-18780 CSRF in TMT Machine's Talassoft Industrial Management Software
Cross-Site request forgery CSRF vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Cross Site Request Forgery. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...
CVE-2026-18780
TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software contains a Cross-Site Request Forgery (CSRF) vulnerability affecting versions V.4 through before V.16 . The vulnerability allows an attacker to forge requests on behalf of an authenticated user, resulting in a High i...
CVE-2026-78012
A stack-based buffer overflow in Pyramid Solutions NetStaX EtherNet/IP Stack prior to v5.6.1 allows a large Class 3 explicit-message request to exceed the application-side receive buffer without generating an error or warning to the originating device. The result can be memory corruption , a devi...
CVE-2026-74835
The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4...
CVE-2026-73812
Erlang/OTP inets (HTTP server module) is vulnerable to HTTP Request Smuggling (CL.TE desync) when deployed behind a Content-Length-preferring front-end proxy. The root cause is in httpd:check_header/3 , which rejects duplicate Content-Length headers but never validates the simultaneous presence o...
CVE-2026-73812
httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...
EUVD-2026-69235
httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...