F5-BIG-IP-SmuggleShell-CVE-2023-46747-Exploit

F5 BIG-IP CVE-2023-46747 – Unauthenticated RCE + Reverse Shell Python3 & Nuclei versions – by raguraman Critical unauth RCE CVSS 9.8 via AJP + HTTP request smuggling Works on all unpatched BIG-IP 13.x → 17.x including latest 17.1.0.3 Patch: https://my.f5.com/manage/s/article/K000137353 Nov 2023...

CVE-2026-57488

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, rawtoint in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values...

CVE-2026-57488 pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, rawtoint in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values...

CVE-2026-57488

The pupnp SDK (versions prior to 2.0.2 ) contains an integer truncation vulnerability in the raw_to_int function located at upnp/src/genlib/net/http/httpparser.c. The root cause is that Content-Length is parsed using strtol and then cast to a 32-bit int before being stored as an unsigned int. On ...

EUVD-2026-102930

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, rawtoint in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values...

Security update for libsoup2

This update for libsoup2 fixes the following issues: CVE-2026-12547: Header "Proxy-Authorization" leads to credentials being send to different proxy after proxy switch bsc1272195. CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol...

poc-h2-CVE-2026-71554

CVE-2026-71554 - h2 Duplicate Host Header Request Smuggling Primitive This is my first CVE, and I have released this PoC to document the finding and help others understand and reproduce it. CVE: CVE-2026-71554 GHSA: GHSA-6hr6-w5qg-qmwg Affected: h2 = 4.4.0 Fixed: h2 4.4.1 Severity: Medium CWE-444...

Security update for libsoup

This update for libsoup fixes the following issues: CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame bsc1271401. CVE-2026-12547: Header "Proxy-Authorization" leads to credentials being send to different proxy after proxy switch bsc1272195. CVE-2026-15711:...

CVE-2026-67182-HTTP-Request-Smuggling-Enables-Front-End-Access-Control-Bypass-rouille-

Security Advisory: HTTP Request Smuggling Enables Front-End Access Control Bypass rouille Assigned CVE ID: CVE-2026-67182 Summary rouille::proxy::proxy and rouille::proxy::fullproxy copy client-supplied request header values into the upstream connection without checking them for control character...

CVE-2026-67181-HTTP-Request-Smuggling-via-Transfer-Encoding-Desynchronization-rouille-

Security Advisory: HTTP Request Smuggling via Transfer-Encoding Desynchronization rouille Assigned CVE ID: CVE-2026-67181 Summary rouille::proxy::proxy forwards the client's Transfer-Encoding header to the backend unchanged, but writes the request body that tinyhttp has already de-chunked. It nev...

request_smuggler

Request smuggler Http request smuggling vulnerability scanner Based on the amazing research by James Kettle. The tool can help to find servers that may be vulnerable to request smuggling vulnerability. Archived The tool needs a lot of improvements, and I don't have enough time to support it as I...

CLEANSTART-2026-NJ74770 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne...

CVE-2026-94439 affects multiple packages. When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. See references for individual vulnerability details...

PT-2026-115882

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

audit-axios

audit-axios Scan local repos for vulnerable axios versions and patch interactively. Targets CVE-2026-40175 — CRLF Header Injection leading to Request Smuggling & SSRF. CVSS 9.9, affects all axios 1.15.0. Quick Start npx audit-axios /Workspace /Projects Usage Interactive — checkbox select + bulk...

CVE-2026-33555

HTTP Request Smuggling via HAProxy H3/QUIC Standalone FIN Body Validation Bypass Full post here : https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html Summary A vulnerability in HAProxy's HTTP/3 implementation allows an attacker to send an HTTP request with a...

CVE-2025-55315-Scanner-Monitor

CVE-2025-55315 Vulnerability Scanner and TLS Proxy This repository contains tools to detect and monitor ASP.NET Core applications vulnerable to CVE-2025-55315, which involves HTTP request smuggling due to conflicting HTTP headers. Tools Included 1. Python Vulnerability Scanner...

CVE-2026-40175-poc

CVE-2026-40175 — Axios CRLF Injection / HTTP Request Smuggling PoC Overview A CRLF injection vulnerability caused by AxiosHeaders.set in the Axios HTTP client =1.0.0 =1.0.0 1.15.0, axios 0.31.0 Patched Versions| 1.15.0, 0.31.0 CWE| CWE-93 Improper Neutralization of CRLF Sequences Root Cause...

CVE-2021-40346

CVE-2021-40346 Integer overflow on header request internal representation allows HTTP request smuggling. This repository presents a PoC built with docker-compose using two docker images: one with a vulnerable version of HaProxy in this case 2.2.16 and one with a Flask web server using Gunicorn as...

cve-2026-69243-poc-aiohttp-smuggling

CVE-2026-69243 — aiohttp Request Smuggling CWE-444 Request smuggling via rejected WebSocket upgrade in aiohttp Or build the Rust version zero dependencies, std only: git clone https://github.com/JVBotelho/cve-2026-69243-poc-aiohttp-smuggling cd cve-2026-69243-poc-aiohttp-smuggling/poc cargo build...

CVE-2025-23167

CVE-2025-23167 – Node.js HTTP Request Smuggling Exploit Working exploit for CVE-2025-23167, a request smuggling vulnerability affecting Node.js 20.x versions prior to v20.19.2. This bug allows improper HTTP header termination, enabling attackers to bypass proxy-based access controls. Files...