EulerOS 2.0 SP13 : haproxy (EulerOS-SA-2026-3018)

According to the versions of the haproxy packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced...

EulerOS 2.0 SP15 : haproxy (EulerOS-SA-2026-2927)

According to the versions of the haproxy packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced...

EulerOS 2.0 SP15 : libsoup (EulerOS-SA-2026-2894)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine...

EulerOS 2.0 SP15 : perl-HTTP-Tiny (EulerOS-SA-2026-2940)

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values.x000D x000D The...

EulerOS 2.0 SP13 : perl-HTTP-Tiny (EulerOS-SA-2026-2986)

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated input...

EulerOS 2.0 SP15 : libsoup (EulerOS-SA-2026-2935)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine...

CVE-2026-9190

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP...

CVE-2026-9190

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP...

CVE-2026-9190 HTTP request smuggling in Progress MarkLogic Server

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP...

CVE-2026-9190

Progress MarkLogic Server versions before 11.3.6 and 12.0.3 contain an HTTP request smuggling flaw in the HTTP App Server. A crafted request with both Content-Length and Transfer-Encoding headers can cause the reverse proxy and MarkLogic Server to misinterpret request boundaries, enabling an atta...

CVE-2026-9190 HTTP request smuggling in Progress MarkLogic Server

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP...

CRLF Injection

undici is vulnerable to CRLF Injection. The vulnerability is due to undici not validating the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher, where an attacker can inject CRLF sequences and append arbitrary HTTP headers,...

SUSE CVE-2026-69243

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability...

CVE-2026-9190: Inconsistent Interpretation of HTTP Requests

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP...

PT-2026-68218

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions prior to 11.3.6 Progress MarkLogic Server versions prior to 12.0.3 Description An HTTP request smuggling issue exists in the HTTP App Server. This occurs when a crafted HTTP request containing both...

CVE-2026-15157

A flaw was found in undici. An application that processes a hand-rolled blob-like request body with a type property derived from untrusted input may allow a remote attacker to inject Carriage Return Line Feed CRLF sequences. This vulnerability enables the attacker to append arbitrary HTTP headers...

Exploit for CVE-2026-69243

CVE-2026-69243 — aiohttp Request Smuggling CWE-444 Request...

Inconsistent Interpretation of HTTP Requests at org.eclipse.jetty:jetty-http dependency in Crucible Server

This is a vulnerability in a non-Atlassian Crucible Server dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity Inconsistent Interpretation of HTTP Requests vulnerability was introduced in version 4.9.0 of Crucible Server. Thi...

org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing

A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access...

org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing

A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access...