147414 matches found
CVE-2025-55702
When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smugg...
DEBIAN-CVE-2025-31699
Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body dat...
CVE-2025-31699
Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body dat...
EUVD-2026-107503
Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16,...
CVE-2026-111809
Apache Traffic Server is vulnerable to request smuggling because it improperly handles HEAD requests that include Content-Length or Transfer-Encoding headers. This issue affects versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. The vulnerability allows for in...
CVE-2026-111809
Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16,...
CVE-2026-114362
The HarnessRouter software (versions up to 0.31.12 ) contains a Server-Side Request Forgery (SSRF) vulnerability within the Targets Test Endpoint component. Specifically, a flaw in an unknown function of the gateway/app.py file allows an attacker to perform a remote manipulation of the base_url a...
CVE-2026-114362 HarnessRouter Targets Test Endpoint app.py server-side request forgery
A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument baseurl can lead to server-side request forgery. The attack may be performed from remote. Upgrading to...
net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses
A flaw was found in Go's net/http package. When an HTTP server sends a successful response to an HTTP/1 CONNECT request without taking raw control of the connection, it improperly continues to process incoming data as standard HTTP requests instead of establishing a tunnel. A remote attacker can...
CVE-2025-55702 Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request
When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smugg...
CVE-2025-55702
Apache Traffic Server versions 8.0.0 through 8.1.11 , 9.0.0 through 9.2.15 , 10.0.0 through 10.1.4 , and 10.2.0 are vulnerable to a request smuggling flaw. The root cause occurs when a client sends a POST request with Expect: 100-continue and the origin responds before the body is read; the serve...
EUVD-2025-211168
When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smugg...
CVE-2025-55702
When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smugg...
CVE-2025-31699 Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling
Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body dat...
EUVD-2025-211167
Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body dat...
CVE-2025-31699
Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body dat...
CVE-2025-31699
Apache Traffic Server is vulnerable to a request smuggling issue where it returns an origin connection to the shared pool while the origin is still waiting for a declared request body. This occurs even when the client uses Expect: 100-continue but fails to send the full body. The origin may then ...
CVE-2026-114493
LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those...
CVE-2026-111401
The Tailored Tools WordPress plugin (versions
CVE-2026-111401 WordPress Tailored Tools plugin <= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Tailored Media Tailored Tools tailored-tools allows Cross Site Request Forgery.This issue affects Tailored Tools: from n/a through 3.0.3...