Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE
CVE-2026-73256
Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an
#cwe-444
共收录 210 条相关情报。
← 返回所有主题Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/express/admin.ts when s...
CVE-2026-55087
Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path
actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: ch...
CVE-2026-73051
actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts re
ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header
CVE-2026-55087
# GHSA-03 — `x-proxy-path` header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fi...
CVE-2026-73495
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42
ServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request smuggling attacks. This vulnerability is addressed in servicetalk version 0.42...
CVE-2026-65370
ServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request smuggling attacks. Th
Microsoft Security Advisory CVE-2026-62899 – .NET Security Feature Bypass Vulnerability
CVE-2026-62899
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Syst
Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-62899
Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker
A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because t...
CVE-2026-14180
A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to han
A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the...
CVE-2026-72587
A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward ...
CVE-2026-71554
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header
Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNE...
CVE-2026-71324
Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default H
h2: Duplicate Host header could facilitate request smuggling
CVE-2026-71554
### Impact h2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header
Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool
CVE-2026-71324
Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default H
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding...
CVE-2026-58044
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild ou
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers...
CVE-2026-58044
该漏洞存在于 Node.js HTTP 客户端模块中，影响基于 Node.js 的转发代理。当代理从传入请求的可见 IncomingMessage 头重建出站 HTTP 头，并将原始请求体直接管道（pipe）到一条复用的后端连接时，攻击者可
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSo...
CVE-2026-69243
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were v
AIOHTTP: HTTP request smuggling via WebSocket upgrade
CVE-2026-69243
### Summary The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. ### Impact
undici vulnerable to downstream response desynchronization via retry interceptor
CVE-2026-16728
### Impact Undici's `interceptors.retry()` can deliver a response whose body length does not match the `Content-Length`
HTTP Smuggling in cPanel allows potential leak of credentials.
CVE-2026-58047
HTTP Smuggling in cPanel allows potential leak of credentials.