CVE-2026-1010-WebSocket-Connection-Smuggling-via-Malformed-Upgrade-Header

CVE-2026-1010 – WebSocket Connection Smuggling Overview A reverse proxy and backend disagree on how to parse an HTTP request with a malformed WebSocket upgrade header. The proxy treats it as one request, while the backend interprets it as two, allowing an attacker to smuggle a hidden request. Thi...

CVE-2020-7693

CVE-2020-7693 Poc Note: I Confirm Payload for CVE-2020-7693 can running in Bug Bounty Program Description: Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20. Single Request Crashes Serve...

PT-2026-89702

Summary There is a high-severity request-smuggling vulnerability in Traefik's handling of the HTTP/1.1 Upgrade mechanism. Since Traefik moved to unencrypted HTTP/2 with prior knowledge Go 1.24, a client-initiated Upgrade: h2c request header and its connection-specific HTTP2-Settings header were...

CentOS 9 : nghttp2-1.43.0-8.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the nghttp2-1.43.0-8.el9 build changelog. - nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...

EUVD-2026-56897

A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an Upgrade: websocket header. An unauthenticated attacker can exploit this by sending a specially crafted HTTP POST request to the /federated...

JLSEC-2026-1157 nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a...

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting...

PT-2026-76194

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting...

CVE-2026-59898

Technical details for CVE-2026-59898 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-59898 Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 or V08 handshaker by sending Sec-WebSocket-Version: 7 and omitting Connection: Upgrade / Upgrade: websocket headers,...

GHSA-4MP9-239F-G9HG Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

Summary An attacker can force WebSocket upgrade via the lax V07 or V08 handshaker by sending Sec-WebSocket-Version: 7 and omitting Connection: Upgrade / Upgrade: websocket headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request...

Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

Summary An attacker can force WebSocket upgrade via the lax V07 or V08 handshaker by sending Sec-WebSocket-Version: 7 and omitting Connection: Upgrade / Upgrade: websocket headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request...

CVE-2026-58055

A flaw in nghttp2's nghttpx proxy allows a remote attacker to perform HTTP request smuggling and cross-client response-queue poisoning. This occurs because the proxy ambiguously forwards HTTP/1.1 Upgrade requests that contain a Content-Length header to reusable keep-alive backend connections...

PYSEC-2026-2503 Granian vulnerable to unauthenticated DoS via WebSocket subprotocol header panic

Summary Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This is a single-request...

OESA-2026-2979 nghttp2 security update

The framing layer of HTTP/2 is implemented as a form of reusable C library. On top of that, we have implemented HTTP/2 client, server and proxy. We have also developed load test and benchmarking tool for HTTP/2. Security Fixes: nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade...

OESA-2026-2978 nghttp2 security update

The framing layer of HTTP/2 is implemented as a form of reusable C library. On top of that, we have implemented HTTP/2 client, server and proxy. We have also developed load test and benchmarking tool for HTTP/2. Security Fixes: nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade...

SUSE CVE-2026-58055

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting...

DEBIAN-CVE-2026-58055

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting...

UBUNTU-CVE-2026-58055

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting...

CVE-2026-58055 nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting...

CVE-2026-58055

nghttp2 nghttpx (up to version 1.69.0) is affected. The proxy forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body to reusable keep-alive backend connections, re-adding Upgrade and Connection headers while passing Content-Length verbatim. This creates an ambiguo...