hsecscan

hsecscan A security scanner for HTTP response headers. Requirements Python 2.x Python Modules os.path argparse sqlite3 urlparse urllib2 urllib json ssl Install $ pip install hsecscan Usage $ hsecscan usage: hsecscan.py -h -P -p -H Header -u URL -R -i -U User-Agent -D DBFILE -d 'POST data' -x PROX...

CVE-2026-128125

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Set-Cookie parsing treats unrecognized name=value attributes as additional cookies, while CookieJar does not limit the number of cookies stored or sent. A malicious server can make an aiohttp client...

CVE-2026-128125 AIOHTTP: Unbounded cookie storage in client CookieJar

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Set-Cookie parsing treats unrecognized name=value attributes as additional cookies, while CookieJar does not limit the number of cookies stored or sent. A malicious server can make an aiohttp client...

EUVD-2026-125756

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Set-Cookie parsing treats unrecognized name=value attributes as additional cookies, while CookieJar does not limit the number of cookies stored or sent. A malicious server can make an aiohttp client...

CVE-2026-66746-HTTP-Response-Splitting-via-Unvalidated-Response-Header-Values-rouille-

Security Advisory: HTTP Response Splitting via Unvalidated Response Header Values rouille Assigned CVE ID: CVE-2026-66746 Summary rouille writes response header values to the client without checking them for carriage return or line feed. An application that places attacker-influenced text into a...

EUVD-2026-122926

Action Pack: Possible sensitive session information leak in Active Storage proxy mode...

UBUNTU-CVE-2026-124249

http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie...

CVE-2026-124249

http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie...

CVE-2026-126077

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, When ActionDispatch::Cookies reads a signed or encrypted cookie that was written under a rotated secret config.actiondispatch.cookiesrotations or in the format that a :hybrid cookie serializer...

CVE-2024-26144-test

CVE-2024-26144-test Requirement: Docker compose Deno $ deno run --allow-run --allow-net check.ts If you want to test CDN, please set the URL in argument. Make sure all caches are purged before run! $ deno run --allow-run --allow-net check.ts https://example.com/ Results If HTTP response contains...

Linux Distros Unpatched Vulnerability : CVE-2026-126077

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, When ActionDispatch::Cookies reads a signed or encrypted...

CVE-2026-126077

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, When ActionDispatch::Cookies reads a signed or encrypted cookie that was written under a rotated secret config.actiondispatch.cookiesrotations or in the format that a :hybrid cookie serializer...

EUVD-2026-116496

Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie...

GHSA-CHP3-J5QR-2VFR Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()

Impact The name, domain, and path fields of makeCookie were validated with a regex that allows ;, the attribute separator in Set-Cookie headers. Because serializeCookie writes those fields verbatim, a caller who passes untrusted input into any of them can append arbitrary attributes to the header...

Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()

Impact The name, domain, and path fields of makeCookie were validated with a regex that allows ;, the attribute separator in Set-Cookie headers. Because serializeCookie writes those fields verbatim, a caller who passes untrusted input into any of them can append arbitrary attributes to the header...

CVE-2026-124249

http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie...

AZL-112916 CVE-2026-124249 affecting package python3 3.12.16-2

http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie...

CVE-2026-124249

The CPython http.cookiejar.CookieJar component is vulnerable to an Origin Validation Error (CWE-346). A server could delete stored cookies belonging to other domains from a shared cookie jar—such as the one used by urllib's HTTPCookieProcessor—by sending a response with an already expired Set-Coo...

CVE-2026-124249 `http.cookiejar` applies expired `Set-Cookie` to cookie store before policy validation

http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie...

CVE-2026-124249 `http.cookiejar` applies expired `Set-Cookie` to cookie store before policy validation

http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie...