PT-2026-70241

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially...

PT-2026-70591

Name of the Vulnerable Software and Affected Versions .NET affected versions not specified Description Inconsistent interpretation of HTTP requests, known as HTTP request/response smuggling, allows an unauthorized attacker to bypass security features over a network. HTTP request smuggling occurs...

nodejs: Node.js: Request smuggling via HTTP client header truncation

A flaw was found in Node.js. The Node.js HTTP client can cause a request desynchronization in forwarding proxies, potentially leading to request smuggling. This vulnerability arises when the HTTP client omits certain headers, such as Content-Length, from being visible to the proxy application whi...

CVE-2026-58044

A flaw was found in Node.js. The Node.js HTTP client can cause a request desynchronization in forwarding proxies, potentially leading to request smuggling. This vulnerability arises when the HTTP client omits certain headers, such as Content-Length, from being visible to the proxy application whi...

SUSE-SU-2026:3557-1 Security update for nodejs22

This update for nodejs22 fixes the following issues: Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

Security update for nodejs22

This update for nodejs22 fixes the following issues: Update to 22.23.2. CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

Security Bulletin:Vulnerability in form-data affects IBM Netezza Appliance

Summary The form-data package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-12143 Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the fie...

Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

Summary Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access Vulnerability Details CVEID:CVE-2026-11932 DESCRIPTION: IBM Security Verify Identity Access is vulnerable to a denial of service attack. CWE:CWE-835: Loop with Unreachable Exit...

OPENSUSE-SU-2026:21546-1 Security update for nodejs24

This update for nodejs24 fixes the following issues: Update to 24.18.1. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

OPENSUSE-SU-2026:21545-1 Security update for nodejs22

This update for nodejs22 fixes the following issues: Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

SUSE-SU-2026:23131-1 Security update for nodejs24

This update for nodejs24 fixes the following issues: Update to 24.18.1. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

SUSE-SU-2026:23155-1 Security update for nodejs24

This update for nodejs24 fixes the following issues: Update to 24.18.1. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

SUSE-SU-2026:23130-1 Security update for nodejs22

This update for nodejs22 fixes the following issues: Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

SUSE-SU-2026:23154-1 Security update for nodejs22

This update for nodejs22 fixes the following issues: Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

Astra Linux – Vulnerability in libsoup3

There is a vulnerability related to request smuggling in LibSoup’s HTTP/1 header parsing logic. The soupmessageheaders.AppendCommon function in libsoup/soup-message-headers.c appends each header value unconditionally, without checking for duplicates or conflicting Content-Length fields. This allo...

Astra Linux – Vulnerability in Erlang

Inconsistent interpretation of HTTP requests: The “HTTP Request Smuggling” vulnerability in Erlang OTP inets httpd module allows for HTTP requests to be disguised. This vulnerability is associated with the program file lib/inets/src/httpserver/httpdrequest.erl and the routine...

Security Bulletin: IBM Operational Decision Manager for July 2026 - Multiple CVEs addressed

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Operational Decision Manager Vulnerability Details CVEID:CVE-2025-11143 DESCRIPTION: The Jetty URI parser has some key differences to other common parsers when...

nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests

A flaw in nghttp2's nghttpx proxy allows a remote attacker to perform HTTP request smuggling and cross-client response-queue poisoning. This occurs because the proxy ambiguously forwards HTTP/1.1 Upgrade requests that contain a Content-Length header to reusable keep-alive backend connections...

Fedora 44 : nghttp2 (2026-084c991d17)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-084c991d17 advisory. - fix HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 Tenable has extracted the preceding...

EulerOS 2.0 SP11 : golang (EulerOS-SA-2026-3068)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encod...