curl: 27: IMAP custom FETCH listing classification skips literal boundaries, enabling response desynchronization

Summary iscustomfetchlistingmatch in lib/imap.c classifies any custom FETCH whose sequence set contains : or , as a "listing." For that classification, imapstatelistsearchresp skips literal detection entirely. The ping-pong line parser then scans the server-declared literal body as IMAP protocol...

undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery.

A flaw was found in undici. An attacker-controlled upstream server can exploit a vulnerability in Undici's HTTP/1.1 client, specifically related to response queue poisoning on reused keep-alive sockets. This allows the attacker to inject an unsolicited HTTP/1.1 response onto an idle socket...