NPM: undici vulnerable to Denial of Service via orphaned RetryHandler response body

NPM: undici vulnerable to Denial of Service via orphaned RetryHandler response body vulnerability discovered by ? in WordPress Npm undici versions = 7.11.0, 7.29.1...

EUVD-2026-71661

undici vulnerable to downstream response splitting via retry interceptor...

undici vulnerable to downstream response splitting via retry interceptor

Impact Undici's interceptors.retry can resume a request after a partial response and append the resumed bytes to an already partially delivered body, while the application still receives the original response's status and headers. When that response carried a Content-Length, the application can...

NPM: undici vulnerable to downstream response splitting via retry interceptor

NPM: undici vulnerable to downstream response splitting via retry interceptor vulnerability discovered by ? in WordPress Npm undici versions 6.28.1...

GHSA-R53P-7PC4-XJ5R undici vulnerable to downstream response splitting via retry interceptor

Impact Undici's interceptors.retry can resume a request after a partial response and append the resumed bytes to an already partially delivered body, while the application still receives the original response's status and headers. When that response carried a Content-Length, the application can...

NPM: undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

NPM: undici vulnerable to response truncation via oversized chunked responses in the dump interceptor vulnerability discovered by ? in WordPress Npm undici versions = 7.1.0, 7.29.1...

undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

Impact undici's interceptors.dump reads and discards response bodies up to a configurable maxSize. When a response declares a Content-Length that exceeds maxSize, the request is aborted cleanly. When a response is sent chunked no Content-Length and its body exceeds maxSize, it is not aborted: the...

EUVD-2026-71517

undici vulnerable to response truncation via oversized chunked responses in the dump interceptor...

GHSA-2GQQ-GQF2-X968 undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

Impact undici's interceptors.dump reads and discards response bodies up to a configurable maxSize. When a response declares a Content-Length that exceeds maxSize, the request is aborted cleanly. When a response is sent chunked no Content-Length and its body exceeds maxSize, it is not aborted: the...

Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

Summary When enablejsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation inste...

GHSA-HJ66-6F7G-4R5V Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

Summary When enablejsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation inste...

EUVD-2026-89010

Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial o...

CVE-2026-75805 NULL Pointer Dereference in CMP Client Revocation Response Handling

Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial o...

CVE-2026-100666

A flaw was found in Netty's HttpServerCodec. A remote attacker can exploit this vulnerability to cause HTTP response desynchronization, leading to response splitting and potential information disclosure. By sending pipelined requests with informational headers followed by another request, the...

httpd: HTTP response splitting forwarding malicious status line

A flaw was found in httpd. When processing responses from an untrusted or compromised backend server, multiple modules fail to sanitize Carriage Return and Line Feed CRLF sequences in the HTTP status line. This issue leads to an HTTP response splitting attack...

Moderate: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP6 security update

Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 6 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

thunderbird: Out-of-bounds read in IMAP response parser

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged ' ID' response, crashing Thunderbird. The affected parsing path is...

Moderate: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP6 security update

Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 6 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

httpd: HTTP response splitting forwarding malicious status line

A flaw was found in httpd. When processing responses from an untrusted or compromised backend server, multiple modules fail to sanitize Carriage Return and Line Feed CRLF sequences in the HTTP status line. This issue leads to an HTTP response splitting attack...

CVE-2026-102507 Sliver 1.7.7 Denial of Service via PE Parser Slice Bounds in Operator RPC

Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a compromised implant to crash the entire teamserver by returning a malformed or empty Download response. Attackers can send zero-length or 1-3...