Security Bulletin: IBM Storage Protect Server is affected by a vulnerability that could allow HTTP request smuggling (CVE-2026-2332).

Summary IBM Storage Protect Server uses the Eclipse Jetty HTTP library in certain components. A vulnerability in Jetty's HTTP/1.1 chunked transfer encoding parser could allow HTTP request smuggling through specially crafted chunk extensions. Due to improper handling of malformed quoted strings...

Apache2 - Transfer-Encoding Chunked XSS

Apache2 PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 contain a reflected cross-site scripting vulnerability caused by mishandling of chunked transfer-encoding requests in sapi/apache2handler/sapiapache2.c. Attackers can execute malicious scripts via crafted...

CVE-2025-55315-detection-playground

Here are some tests that can be performed against these services to observe different behavior on GET/POST routes between the patched and unpatched versions of Kestrel. GET against unpatched sends 200 and socket remains open printf 'GET / HTTP/1.1\r\nHost: localhost\r\nTransfer-Encoding:...

CVE-2026-66752-HTTP-Request-Smuggling-via-Unparsed-Transfer-Encoding-Values-tiny_http-

Security Advisory: HTTP Request Smuggling via Unparsed Transfer-Encoding Values tinyhttp Assigned CVE ID: CVE-2026-66752 Summary tinyhttp checks only whether a Transfer-Encoding header is present. It never looks at the value. Any value, including codings that are not chunked and coding lists whos...

CVE-2013-2028-Exploit

CVE-2013-2028 Exploit Vulnerability Details Vulnerable software: Nginx 1.3.9 Vulnerable function: ngxhttpparsechunked CVE-2013-2028 is an integer overflow vulnerability in Nginx's HTTP chunked transfer encoding parser. Under the conditions targeted by this laboratory environment, the vulnerabilit...

CVE-2020-25613

POC POST / HTTP/1.1 Host: 127.0.0.1:1080 Content-Type: text/html Content-Length: 129 Connection: keep-alive Transfer-Encoding: 0xb chunked 1 A 0 POST /flag HTTP/1.1 Host: 127.0.0.1:1080 Content-Length: 180 Connection: keep-alive Content-Type: text/html URI:...

Linux Distros Unpatched Vulnerability : CVE-2026-111809

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer- Encoding. This issue affects Apache Traffic Server: from...

openSUSE 16 Security Update : tinyproxy (openSUSE-SU-2026:22133-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22133-1 advisory. Changes in tinyproxy: - Fixed failure to reconcile conflicting Content-Length and Transfer-Encoding boo1268474, CVE-2026-54387 - Fixed failure t...

Linux Distros Unpatched Vulnerability : CVE-2026-111816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out...

CVE-2026-67181-HTTP-Request-Smuggling-via-Transfer-Encoding-Desynchronization-rouille-

Security Advisory: HTTP Request Smuggling via Transfer-Encoding Desynchronization rouille Assigned CVE ID: CVE-2026-67181 Summary rouille::proxy::proxy forwards the client's Transfer-Encoding header to the backend unchanged, but writes the request body that tinyhttp has already de-chunked. It nev...

DEBIAN-CVE-2026-111809

Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16,...

CVE-2026-111809

Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16,...

DEBIAN-CVE-2026-111816

Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and...

CVE-2026-111816

Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and...

CVE-2026-111809

Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16,...

EUVD-2026-107503

Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16,...

CVE-2026-111809

Apache Traffic Server is vulnerable to request smuggling because it improperly handles HEAD requests that include Content-Length or Transfer-Encoding headers. This issue affects versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. The vulnerability allows for in...

CVE-2026-111816

Apache Traffic Server versions 8.0.0 through 8.1.11 , 9.0.0 through 9.2.15 , 10.0.0 through 10.1.4 , and 10.2.0 are vulnerable to a flaw where a malformed 302 response bypasses parse-error rejection. This occurs because the Transfer-Encoding: chunked carve-out allows the server to forward respons...

EUVD-2026-107493

Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and...

CVE-2026-111816

Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and...