DEBIAN-CVE-2026-89044

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding...

PYSEC-2026-3849 HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

Summary HTTPX2 can automatically add a Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. The resulting HTTP/1.1 request contains both framing headers, which can create an ambiguous message boundary and enable request smuggling or connection...

PT-2026-89523

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libevent (UTSA-2026-106158)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106158 advisory. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding...

PT-2026-84846

Name of the Vulnerable Software and Affected Versions HTTPX2 versions prior to 2.11.0 Description The Request. prepare function in src/httpx2/httpx2/ models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. This occurs...

Astra Linux – Vulnerability in JRuby

A vulnerability was discovered in Ruby versions 2.5.8, 2.6.x up to 2.6.6, and 2.7.x up to 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, did not rigorously check the transfer-encoding header value. An attacker could potentially exploit this vulnerability to bypass a reverse proxy which...

Astra Linux – Vulnerability in Netty

The HttpObjectDecoder.java file in Netty before version 4.1.44 allowed a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header...

Astra Linux – Vulnerability in Gunicorn

Gunicorn version 21.2.0 does not properly validate the value of the ‘Transfer-Encoding’ header as specified in the RFC standards. This results in the use of the default fallback method ‘Content-Length’, making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisonin...

AZL-96944 CVE-2026-63382 affecting package libevent for versions less than 2.1.13-1

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

CVE-2026-63382

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

CVE-2026-63382 libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

CVE-2026-9190 HTTP request smuggling in Progress MarkLogic Server

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP...

PT-2026-68218

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions prior to 11.3.6 Progress MarkLogic Server versions prior to 12.0.3 Description An HTTP request smuggling issue exists in the HTTP App Server. This occurs when a crafted HTTP request containing both...

Security Bulletin: IBM Storage Protect Server is affected by multiple vulnerability in the netty-codec-http library that could allow an attacker to exploit integer overflow conditions when processing chunked HTTP requests(CVE-2026-42581, CVE-2026-42584).

Summary IBM Storage Protect Server uses the netty-codec-http library in certain components. Netty is vulnerable to multiple vulnerability that could allow an attacker to exploit integer overflow conditions when processing chunked HTTP requests. This may lead to inconsistent request parsing and...

CVE-2026-67181

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to...

CVE-2026-67181 Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding Header

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to...

CVE-2026-67181

Rouille versions 0.3.3 through 3.6.2 are affected by an HTTP request smuggling vulnerability via the proxy Transfer-Encoding header. The issue arises because the proxy in src/proxy.rs forwards the client’s Transfer-Encoding header to upstream backends unchanged while transmitting a body that has ...

EUVD-2026-49881

tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-Encoding header with any value, including non-chunked codings, which causes the library to unconditionally apply chunk-decoding and discard...

CVE-2026-66731 facil.io 0.7.5 - 0.7.6 HTTP/1.1 Chunked Transfer Encoding Parser Crash DoS

facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser that allows unauthenticated remote attackers to crash the server by sending a negative chunk size value. Attackers can send a single POST request with a Transfer-Encoding:...

PYSEC-2026-1433 Gunicorn HTTP Request/Response Smuggling vulnerability

Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data...