Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE
CVE-2026-88975
### Summary An unauthenticated peer can make Ember's HTTP/2 read loop hold 16 MiB of a single frame in memory on a conne
#maven
共收录 259 条相关情报。
← 返回所有主题Http4s: ResourceService and Webjar Service path escape via percent-encoded separators
CVE-2026-69201
The static content handlers `ResourceService` and `WebjarService` URL decode each path segment and then reject only segm
Http4s Ember HTTP/2: unbounded continuation frame accumulation
CVE-2026-69218
When Ember receives an HTTP/2 `HEADERS` or `PUSH_PROMISE` frame without the `END_HEADERS` flag, it buffers the header bl
Http4s: Ember chunk parser lenience (TE.TE request smuggling)
CVE-2026-69216
## Summary Ember's chunk decoder parses the size token leniently: it strips leading and trailing whitespace and accepts
Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin
CVE-2026-69215
The `CookieJar` client middleware decides whether to attach a cookie to an outgoing request using an unanchored substrin
Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain
CVE-2026-69214
When processing a `Set-Cookie` from a response, the `CookieJar` client middleware trusts the server-supplied `Domain` at
Http4s Ember HTTP/2 has an unbounded outbound frame queue
CVE-2026-69213
Ember's HTTP/2 connection serializes all outgoing frames through a single unbounded queue drained by one writer fiber (`
Http4s: DigestAuth nonce map grows unbounded
CVE-2026-69208
The `DigestAuth` server middleware's stale-nonce cleanup uses an inverted comparison: it removes *fresh* nonces and stop
Http4s: DigestAuth allows replay of captured requests
CVE-2026-69206
The `DigestAuth` replay defence stores `lastNc + 1` rather than the nonce-count (`nc`) value it just accepted. When a le
Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)
CVE-2026-69205
## Summary Ember's HTTP/1.1 header parser matches the `Transfer-Encoding` header value with a case-sensitive substring
Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)
CVE-2026-69204
## Summary Ember's HTTP/1.1 request parser does not reject a message that carries both a `Transfer-Encoding` and a `Con
Http4s Ember HTTP/2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS
CVE-2026-69203
An ember server with HTTP/2 enabled (`.withHttp2`) does not enforce `SETTINGS_MAX_CONCURRENT_STREAMS` on streams opened
Http4s Ember HTTP/2: unbounded inbound body buffering
CVE-2026-69202
Ember's HTTP/2 stack replenishes the inbound flow-control window based on bytes received off the wire, not bytes consume
Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)
CVE-2026-11745
# Vulnerability Central Dogma's Git mirror SSH client installs an Apache MINA SSHD `ServerKeyVerifier` lambda that retu
Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover
CVE-2026-11746
## Vulnerability `ZooKeeperReplicationConfig.secret()` silently substitutes the hard-coded constant `"ch4n63m3"` (leets
Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion
CVE-2026-11748
# Vulnerability `SearchFirstActiveDirectoryRealm.findUserDn()` substitutes the user-supplied username from the login fo
Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass
CVE-2026-63490
### Summary `com.github.jknack.handlebars.springmvc.SpringTemplateLoader` resolves Spring MVC view names into URLs via S
org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)
CVE-2026-55860
### Summary The connector does not gate clear-text password authentication plugins on transport encryption. A hostile o
org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output
CVE-2026-55859
### Summary The connector encodes and decodes all character data assuming the connection character set is UTF-8. A serv
org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context
CVE-2026-55858
### Summary The connector encodes and decodes all character data assuming the connection character set is UTF-8. A serv