Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
## Summary Axios versions with Node.js HTTP/2 support allow streamed request bodies to bypass `maxBodyLength` enforceme
#cwe-400
共收录 1383 条相关情报。
← 返回所有主题The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name function of the file /goform/SetOnlineDevName
CVE-2024-51316
The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name function of the file /g
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on...
CVE-2026-53596
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeSco
Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA p...
CVE-2026-45713
Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.M
Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes
CVE-2026-45713
Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.M
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close Since hci_dev_close_sync() can now be ...
CVE-2026-63974
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE du
JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal ...
CVE-2026-56741
JLine 是一个用于处理控制台输入的 Java 库。在版本 3.30.14、4.0.16 和 4.2.1 之前，JLine3 的 Telnet 服务器远程 Telnet 模块未对通过 Telnet NAWS 选项接收的终端尺寸设置上限。在
JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment v...
CVE-2026-56740
CVE-2026-56740 是影响 JLine 库（Java 控制台输入处理）的一个拒绝服务漏洞。JLine 3 版本中的 Telnet 服务器模块（remote-telnet）在处理 Telnet NEW-ENVIRON 选项时，未对客
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept...
CVE-2026-49485
CVE-2026-49485 是 HAPI FHIR 库中的一个拒绝服务漏洞。HAPI FHIR 是基于 Java 的 HL7 FHIR 标准完整实现，用于医疗保健互操作性。该漏洞影响 6.9.9 和 6.9.4.2 之前的所有版本。漏洞根
IBM PowerVM Novalink are vulnerable to a denial of service, caused by sending a specially-crafted...
CVE-2026-9171
IBM PowerVM Novalink are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote atta
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDeco...
CVE-2026-44891
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2
IBM PowerVM Novalink are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server...
CVE-2026-9171
IBM PowerVM Novalink are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote atta
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods ...
CVE-2026-47183
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exceptio
Zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion
CVE-2026-47183
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exceptio
vLLM: Speech-to-text upload size limit is enforced after full UploadFile read
CVE-2026-55646
## Summary Current-head vLLM documents `VLLM_MAX_AUDIO_CLIP_FILESIZE_MB` as the maximum audio file size accepted by the
Mattermost Desktop App versions <=6.2 6.0.2 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App which allows a malicious server owner to crash...
CVE-2026-9602
Mattermost Desktop App versions <=6.2 6.0.2 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the D
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression ampli...
CVE-2026-54340
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state am
Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 3.9.0 and above, prior to 4.14.5, a remote attacker can trigger memory ...
CVE-2026-33754
Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 3.9.0 and abov
Wazuh: Unauthenticated cluster packet length leads to uncontrolled memory allocation (remote DoS)
CVE-2026-33754
Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 3.9.0 and abov
h2o has HTTP/2 state amplification
CVE-2026-54340
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state am