29 matches found
CVE-2026-66753-HTTP-Header-Injection-via-Unvalidated-CR-and-LF-in-Header-Values-tiny_http-
Security Advisory: HTTP Header Injection via Unvalidated CR and LF in Header Values tinyhttp Assigned CVE ID: CVE-2026-66753 Summary tinyhttp does not reject carriage return or line feed inside HTTP header values, in either direction. On the request side, readnextline ends a header line only on...
CVE-2026-66752-HTTP-Request-Smuggling-via-Unparsed-Transfer-Encoding-Values-tiny_http-
Security Advisory: HTTP Request Smuggling via Unparsed Transfer-Encoding Values tinyhttp Assigned CVE ID: CVE-2026-66752 Summary tinyhttp checks only whether a Transfer-Encoding header is present. It never looks at the value. Any value, including codings that are not chunked and coding lists whos...
Linux Distros Unpatched Vulnerability : CVE-2026-66752
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a...
📄 rouille 3.6.2 HTTP Request Smuggling
rouille versions 3.6.2 and earlier contain an HTTP request smuggling vulnerability in the reverse proxy implementation. The proxy forwards the client's Transfer-Encoding header unchanged while forwarding a de-chunked request body, allowing backend request desynchronization and, under certain...
📄 tiny_http 0.12.0 HTTP Header Injection
tinyhttp versions 0.12.0 and earlier contain an HTTP header injection vulnerability due to improper validation of carriage return and line feed characters in HTTP header values. Applications that reflect or forward attacker-controlled header values can be vulnerable to HTTP response splitting,...
📄 tiny_http 0.12.0 HTTP Request Smuggling
tinyhttp versions 0.12.0 and earlier contain an HTTP request smuggling vulnerability caused by improper handling of the Transfer-Encoding header. The library checks only for the presence of the header rather than validating its value, allowing inconsistent HTTP request parsing between front-end...
CVE-2026-67181
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to...
EUVD-2021-1626
Malware in sbrugna...
CVE-2020-35884
An issue was discovered in the tinyhttp crate through 2020-06-16 for Rust. HTTP Request smuggling can occur via a malformed Transfer-Encoding header...
Fedora: Security Advisory for rust-tiny_http (FEDORA-2021-c824326120)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Fedora: Security Advisory for rust-tiny_http (FEDORA-2021-571e3ed33c)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
[SECURITY] Fedora 35 Update: rust-tiny_http-0.8.2-1.fc35
Low level HTTP server library...
[SECURITY] Fedora 34 Update: rust-tiny_http-0.8.2-1.fc34
Low level HTTP server library...
abrute (>=0.1.7, <=0.1.9), alipay-rs (>=0.2.0, <=0.4.6) +57 more potentially affected by CVE-2020-35884 via tiny_http (>=0.4.1, <=0.7.0)
tinyhttp CARGO version =0.4.1, =0.1.7, =0.2.0, =0.0.1, =0.1.0, =0.0.1, =0.15.7, =0.1.0, =0.7.0, =0.1.1, =0.1.0, =1.0.0, =3.1.0 - ewer 0.0.2 - fatcat-openapi 0.3.1 and more Source cves: CVE-2020-35884 Source advisory: GHSA-7V2R-WXMG-MGVC...
HTTP Request smuggling in tiny_http
HTTP pipelining issues and request smuggling attacks are possible due to incorrect Transfer encoding header parsing. It is possible conduct HTTP request smuggling attacks CL:TE/TE:TE by sending invalid Transfer Encoding headers. By manipulating the HTTP response the attacker could poison a...
GHSA-7V2R-WXMG-MGVC HTTP Request smuggling in tiny_http
HTTP pipelining issues and request smuggling attacks are possible due to incorrect Transfer encoding header parsing. It is possible conduct HTTP request smuggling attacks CL:TE/TE:TE by sending invalid Transfer Encoding headers. By manipulating the HTTP response the attacker could poison a...
abrute (>=0.1.7, <=0.1.9), alipay-rs (>=0.2.0, <=0.4.6) +57 more potentially affected by CVE-2020-35884 via tiny_http (>=0.4.1, <=0.7.0)
tinyhttp CARGO version =0.4.1, =0.1.7, =0.2.0, =0.0.1, =0.1.0, =0.0.1, =0.15.7, =0.1.0, =0.7.0, =0.1.1, =0.1.0, =1.0.0, =3.1.0 - ewer 0.0.2 - fatcat-openapi 0.3.1 and more Source cves: CVE-2020-35884 Source advisory: OSV:GHSA-7V2R-WXMG-MGVC...
Mozilla Rust tiny_http crate environment issue vulnerability
Rust is a general-purpose, compiled programming language from the Mozilla Foundation. An environmental issue vulnerability exists in tinyhttp crate in versions of Mozilla Rust prior to 2020-06-16, which stems from an HTTP request smuggling can occur via a misformatted transport encoding header. N...
