#cwe-444

共收录 210 条相关情报。

漏洞预警2026-09-15 发布INFO

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HeaderP.parse uses a case-sensitive substring test for the Transfer-Encoding value and dec...

CVE-2026-69205

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HeaderP.parse uses a case-sensiti

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

安全公告2026-09-15 发布INFO

Http4s: Ember chunk parser lenience (TE.TE request smuggling)

CVE-2026-69216

## Summary Ember's chunk decoder parses the size token leniently: it strips leading and trailing whitespace and accepts

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #maven #cwe-444 #severity:medium

安全公告2026-09-15 发布INFO

Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)

CVE-2026-69205

## Summary Ember's HTTP/1.1 header parser matches the `Transfer-Encoding` header value with a case-sensitive substring

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #maven #cwe-444 #severity:high

安全公告2026-09-15 发布INFO

Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

CVE-2026-69204

## Summary Ember's HTTP/1.1 request parser does not reject a message that carries both a `Transfer-Encoding` and a `Con

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #maven #cwe-444 #severity:critical

漏洞预警2026-09-15 发布INFO

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s chunk decoder trims the chunk-size token and accepts leading plus or minus signs instead o...

CVE-2026-69216

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s chunk decoder trims the chunk-siz

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-09-15 发布INFO

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so a...

CVE-2026-69204

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages c

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-09-15 发布INFO

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Atta...

CVE-2024-14029

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body a

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-09-15 发布INFO

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send cra...

CVE-2023-54397

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-09-14 发布INFO

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP tra...

CVE-2026-15634

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP requ

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

漏洞预警2026-09-14 发布INFO

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP tra...

CVE-2026-15396

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP requ

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

安全公告2026-09-10 发布INFO

Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

CVE-2026-88008

## Summary There is a high-severity request-smuggling vulnerability in Traefik's handling of the HTTP/1.1 `Upgrade` mec

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-444 #cwe-863 #severity:high

安全公告2026-09-10 发布INFO

Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

CVE-2026-88009

## Summary Traefik accepts an HTTP/1.x request whose request-target is in rootless / opaque form (for example `GET http

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-444 #cwe-1286 #severity:high

漏洞预警2026-09-10 发布INFO

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, all...

CVE-2026-89044

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the f

历史摘要 · 未重新核验 · NVD

#cve #cwe-444

安全公告2026-09-10 发布INFO

Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding

CVE-2026-89044

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the f

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-444

漏洞预警2026-09-10 发布INFO

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while...

CVE-2026-88009

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless

历史摘要 · 未重新核验 · NVD

#cve #cwe-444 #cwe-1286

漏洞预警2026-09-10 发布INFO

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, t...

CVE-2026-88008

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards

历史摘要 · 未重新核验 · NVD

#cve #cwe-444 #cwe-863

安全公告2026-09-10 发布INFO

Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

CVE-2026-88009

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-1286 #cwe-444

安全公告2026-09-10 发布INFO

Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

CVE-2026-88008

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-444 #cwe-863

安全公告2026-09-08 发布INFO

Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

CVE-2026-84363

### Summary Hono's query parsing does not stop at the URL fragment: a `?` appearing after a `#` is treated as the start

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-444 #severity:medium

漏洞预警2026-09-08 发布INFO

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentiall...

CVE-2026-19203

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary pr

历史摘要 · 未重新核验 · NVD

#cve #cwe-444