CVE-2026-66746-HTTP-Response-Splitting-via-Unvalidated-Response-Header-Values-rouille-

Security Advisory: HTTP Response Splitting via Unvalidated Response Header Values rouille Assigned CVE ID: CVE-2026-66746 Summary rouille writes response header values to the client without checking them for carriage return or line feed. An application that places attacker-influenced text into a...

CVE-2024-26144-test

CVE-2024-26144-test Requirement: Docker compose Deno $ deno run --allow-run --allow-net check.ts If you want to test CDN, please set the URL in argument. Make sure all caches are purged before run! $ deno run --allow-run --allow-net check.ts https://example.com/ Results If HTTP response contains...

GHSA-CHP3-J5QR-2VFR Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()

Impact The name, domain, and path fields of makeCookie were validated with a regex that allows ;, the attribute separator in Set-Cookie headers. Because serializeCookie writes those fields verbatim, a caller who passes untrusted input into any of them can append arbitrary attributes to the header...

CVE-2026-124249

The CPython http.cookiejar.CookieJar component is vulnerable to an Origin Validation Error (CWE-346). A server could delete stored cookies belonging to other domains from a shared cookie jar—such as the one used by urllib's HTTPCookieProcessor—by sending a response with an already expired Set-Coo...

SUSE CVE-2026-120644

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request...

DEBIAN-CVE-2026-120644

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request...

CVE-2026-120644

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request...

CVE-2026-120644

The CGI::Cookie module for Perl (versions before 5.00 ) is vulnerable to cookie attribute injection due to insufficient validation of the path, domain, and expires values. The module fails to check for semicolons or control characters before writing these values into the Set-Cookie header. If an ...

CVE-2026-120644 CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request...

CVE-2026-120644 CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request...

CVE-2026-120644

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request...

CVE-2026-115779

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie allow semicolon delimiters tha...

CVE-2026-115779

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie allow semicolon delimiters tha...

CVE-2026-115779

The Effect TypeScript framework is vulnerable to cookie attribute injection in the @effect/platform package. Specifically, versions 0.1.0 through 0.97.1 (and effect versions 4.0.0-beta.0 through 4.0.0-beta.103 ) fail to sanitize semicolon delimiters in the name, domain, and path fields passed to ...

PT-2026-136751

Name of the Vulnerable Software and Affected Versions CGI::Cookie versions prior to 5.00 Description Insufficient validation of path, domain, and expires values allows for cookie attribute injection. These values are written into the Set-Cookie header without checking for control characters or...

Effect input validation error vulnerability

Versions of Effect prior to 0.1.0 and from 0.97.1 up to 4.0.0-beta.0 and 4.0.0-beta.103 contain an input validation error vulnerability. This vulnerability arises because the name, domain, and path fields in makeCookie allow semicolon separators; serializeCookie writes these values unchanged into...

CVE-2026-88038

A flaw was found in the cookies Node.js library. This vulnerability allows a remote attacker to inject additional cookie attributes into the Set-Cookie header by providing untrusted data to the domain or path options. This occurs because the library's validation for these options is permissive,...

Rocky Linux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790152441)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790152441 advisory. - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handle...

EUVD-2026-71518

undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches...

PT-2026-108572

Security vulnerability affects the langfuse package. undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header...