CVE-2026-44578

🚨 CVE-2026-44578 — Vulnerabilità SSRF di Next.js 📌 Panoramica CVE-2026-44578 è una vulnerabilità Server-Side Request Forgery SSRF di alta gravità che colpisce le applicazioni Next.js self-hosted. Gli attaccanti possono sfruttare richieste di upgrade WebSocket appositamente create per forzare il...

CVE-2026-44578-PoC

CVE-2026-44578 - Next.js WebSocket SSRF PoC Vulnerabilità: Server-Side Request Forgery nel gestore di upgrade WebSocket di Next.js 13.4.13 → 15.5.15, 16.0.0 → 16.1.6 Utilizzo root@kitploit: Detect vulnerability python3 poc.py target.com:3000 --detect Tunnel to internal Redis python3 poc.py...

cve-2026-69243-poc-aiohttp-smuggling

CVE-2026-69243 — aiohttp Request Smuggling CWE-444 Request smuggling tramite upgrade WebSocket rifiutato in aiohttp Oppure compila la versione Rust zero dipendenze, solo std: root@kitploit: git clone https://github.com/JVBotelho/cve-2026-69243-poc-aiohttp-smuggling cd...

nextssrf

root@kitploit: ╔══════════════════════════════════════════════════════════════╗ ║ NextSSRF — CVE-2026-44578 Scanner & Exploit ║ ║ Next.js WebSocket Upgrade Handler SSRF ║ ║ Affected: 13.4.13 → 15.5.15, 16.0.0 → 16.2.4 ║ ║ @mitsec / ynsmroztas — Bug Bounty Tooling ║...

CVE-2020-7693

CVE-2020-7693 Poc Nota: Confirmo que o payload para o CVE-2020-7693 pode ser executado em programas de Bug Bounty Descrição: O tratamento incorreto do cabeçalho Upgrade com o valor websocket leva à queda dos containers que hospedam aplicações sockjs. Isso afeta o pacote sockjs anterior à versão...

verify-ghsa-c4j6-fc7j-m34r

verify-ghsa-c4j6-fc7j-m34r In-Band-Verifizierer für GHSA-c4j6-fc7j-m34r / CVE-2026-44578 – Serverseitige Anfragenfälschung SSRF in Next.js über WebSocket-Upgrade-Anfragen. ⚠️ Nur für autorisierte Sicherheitstests. Sie sind dafür verantwortlich sicherzustellen, dass Sie die Erlaubnis haben, jedes...

CVE-2026-44578

CVE-2026-44578 — SSRF nell'aggiornamento WebSocket di Next.js Server-Side Request Forgery pre-autenticazione nelle distribuzioni self-hosted di Next.js. Una singola richiesta HTTP appositamente costruita estrae credenziali AWS, segreti e dati di servizi interni da localhost:80...

cve-2018-1002105

CVE-2018-1002105 Utility di test che verifica se un cluster è affetto dalla vulnerabilità Kubernetes ad alta severità pubblicata qui. Un'analisi a livello stakeholder della CVE-2018-1002105 è disponibile su https://gravitational.com/blog/kubernetes-websocket-upgrade-security-vulnerability/...

cve-2018-1002105

Questo è stato modificato da https://gravitational.com/blog/kubernetes-websocket-upgrade-security-vulnerability/. Tutto il merito va alle gentili persone di Gravitational. Il codice PoC originale è stato modificato per andare un po' oltre la verifica della vulnerabilità e per eseguire...

aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...

aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...

Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests

A flaw was found in Next.js. Self-hosted applications utilizing the built-in Node.js server are vulnerable to Server-Side Request Forgery SSRF through specially crafted WebSocket upgrade requests. A remote attacker can exploit this by causing the server to proxy requests to arbitrary internal or...

CVE-2026-69243

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...

SUSE CVE-2026-69243

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability...

AIOHTTP: HTTP request smuggling via WebSocket upgrade

SummaryThe HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. ImpactIf using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unaware ...

PYSEC-2026-3546 AIOHTTP: HTTP request smuggling via WebSocket upgrade

Summary The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. Impact If using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unawar...

Linux Distros Unpatched Vulnerability : CVE-2026-69243

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack...

CVE-2026-69243

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability...

AZL-94547 CVE-2026-69243 affecting package python-aiohttp 3.6.2-3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability...

GHSA-MFX4-HV73-Q22V AIOHTTP: HTTP request smuggling via WebSocket upgrade

Summary The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. Impact If using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unawar...