uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but compares the `Transfer-Encoding` value to `ch...

CVE-2026-55614

uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases heade

来源摘录 · NVD

uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HTTP request boundaries when a `POST /ubus` JSON body arriv...

CVE-2026-55613

uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HT

来源摘录 · NVD

uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX...

CVE-2026-55612

uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an in

来源摘录 · NVD

Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection. The request method is not...

CVE-2026-116127

Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persi

来源摘录 · NVD

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security...

CVE-2026-91920

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encod

来源摘录 · NVD / GitHub Advisory

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the con...

CVE-2026-118264

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a clien

来源摘录 · NVD / OSV.dev

Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents.

CVE-2026-103995

Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpret

来源摘录 · NVD

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing...

CVE-2026-115823

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive

历史摘要 · 未重新核验 · GitHub Advisory

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an ...

CVE-2026-115877

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.

来源摘录 · NVD

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

## Impact Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validatin

历史摘要 · 未重新核验 · GitHub Advisory

Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

CVE-2026-115877

## Summary An incomplete header-value validation (CWE-444) in the Twisted HTTP server lets a bare carriage return or li

历史摘要 · 未重新核验 · GitHub Advisory

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unau...

CVE-2026-112212

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 1

来源摘录 · NVD

Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 through ...

CVE-2026-111809

Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This

历史摘要 · 未重新核验 · NVD

Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection...

CVE-2026-111816

Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Tr

历史摘要 · 未重新核验 · NVD

When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection a...

CVE-2025-55702

When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Serv

历史摘要 · 未重新核验 · NVD

Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including ...

CVE-2025-31699

Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request

历史摘要 · 未重新核验 · NVD

Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version < 1.18.0) on all platforms allows remote at...

CVE-2026-86146

Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache

来源摘录 · NVD

AIOHTTP: Pure-Python parser request smuggling

CVE-2026-111750

### Summary The pure Python parser is vulnerable to an HTTP request smuggling attack. ### Impact If users are using t

历史摘要 · 未重新核验 · GitHub Advisory

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request...

CVE-2026-93003

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the

历史摘要 · 未重新核验 · NVD

Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to the upstream without rem...

CVE-2026-105299

Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstrea

历史摘要 · 未重新核验 · NVD