Linux Distros Unpatched Vulnerability : CVE-2026-93579

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage...

PT-2026-95828

Name of the Vulnerable Software and Affected Versions Pod::Text versions prior to 6.1.1 Description Formatting a POD document with excessive =over nesting can lead to CPU and memory exhaustion. Each =over element increases the margin, which the wrap function subtracts from the output width to...

CVE-2026-93579

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...

DEBIAN-CVE-2026-93579

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...

UBUNTU-CVE-2026-93579

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...

CVE-2026-93579

A vulnerability in Netty's netty-codec-http2 module allows a remote attacker to inject prohibited characters—NUL, Line Feed, and Carriage Return —into HTTP/2 header field values due to insufficient default validation. When such values cross an HTTP/2 to HTTP/1.1 translation boundary , the injecte...

CVE-2026-93579 Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...

CVE-2026-93579

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...

CVE-2026-93579: Undefined Security Weakness

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...

CVE-2026-55061 uniget: EDITOR Command Injection in uniget CLI

uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGETEDITOR or EDITOR with strings.Spliteditor, " " and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can...

HTTP Response Splitting

Overview Affected versions of this package are vulnerable to HTTP Response Splitting via the HTTP/1.1 request parsing logic in sanic/http/http1.py, where malformed or conflicting transfer-encoding and content-length headers allow an attacker to inject a smuggled request into the processing...

CVE-2026-69211

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated...

CVE-2026-69211 Http4s: Set-Cookie rendering does not escape attribute delimiters

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated...

CVE-2026-69211 Http4s: Set-Cookie rendering does not escape attribute delimiters

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated...

EUVD-2026-79175

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated...

CVE-2026-69211

Http4s is a Scala library for HTTP services. Prior to 0.23.35 and 1.0.0-M47 , the ResponseCookie.render method writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from u...

CVE-2026-69211 Http4s: Set-Cookie rendering does not escape attribute delimiters

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated...

CVE-2024-58384 Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests...

PT-2026-92380

Name of the Vulnerable Software and Affected Versions Http4s versions prior to 0.23.35 Http4s versions prior to 1.0.0-M47 Description The ResponseCookie.render function fails to neutralize semicolons or control characters when writing name, content, domain, path, and extension values. If an...

CVE-2026-69211: Improper Neutralization of CRLF Sequences in HTTP Headers

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated...