https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 18:49:52 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-93562 <p>A flaw was found in Netty&#39;s HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.</p> <p>A flaw was found in Netty&#39;s HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-93562 https://vulnerability.circl.lu/vuln/ghsa-c599-gp9v-cp79 <p>A flaw was found in Netty&#39;s HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.</p> <p>A flaw was found in Netty&#39;s HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.</p> https://vulnerability.circl.lu/vuln/ghsa-c599-gp9v-cp79 https://vulnerability.circl.lu/vuln/opensuse-su-2026:11882-1 <p>netty-4.1.138-1.1 on GA media</p> <p>netty-4.1.138-1.1 on GA media</p> https://vulnerability.circl.lu/vuln/opensuse-su-2026:11882-1 https://vulnerability.circl.lu/vuln/rhsa-2026:69440 <p>org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding io.projectreactor/reactor-core: Reactor Core: Denial of Service via Flux.windowTimeout operator with fairBackpressure io.projectreactor/reactor-core: Reactor Core: Denial of Service in bufferTimeout operator org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names org.jsoup/jsoup: jsoup: Denial of Service via deeply nested XML documents org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver quarkus-websockets-next: Denial of Service (OOM) in quarkus-websockets-next via unbounded message buffering quarkus-vertx-http: Authorization Bypass via Path Normalization Discrepancy in Quarkus HTTP Security com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service com.github.luben/zstd-jni: zstd-jni: Denial of Service or Information Disclosure via out-of-bounds read com.github.luben/zstd-jni: zstd-jni…</p> <p>org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding io.projectreactor/reactor-core: Reactor Core: Denial of Service via Flux.windowTimeout operator with fairBackpressure io.projectreactor/reactor-core: Reactor Core: Denial of Service in bufferTimeout operator org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names org.jsoup/jsoup: jsoup: Denial of Service via deeply nested XML documents org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver quarkus-websockets-next: Denial of Service (OOM) in quarkus-websockets-next via unbounded message buffering quarkus-vertx-http: Authorization Bypass via Path Normalization Discrepancy in Quarkus HTTP Security com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service com.github.luben/zstd-jni: zstd-jni: Denial of Service or Information Disclosure via out-of-bounds read com.github.luben/zstd-jni: zstd-jni…</p> https://vulnerability.circl.lu/vuln/rhsa-2026:69440 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-93562 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: netty, Ubuntu:Pro:16.04:LTS: netty, Ubuntu:Pro:18.04:LTS: netty, Ubuntu:Pro:20.04:LTS: netty, Ubuntu:Pro:22.04:LTS: netty, Ubuntu:Pro:24.04:LTS: netty, Ubuntu:Pro:26.04:LTS: netty</p> <p>A flaw was found in Netty&#39;s HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: netty, Ubuntu:Pro:16.04:LTS: netty, Ubuntu:Pro:18.04:LTS: netty, Ubuntu:Pro:20.04:LTS: netty, Ubuntu:Pro:22.04:LTS: netty, Ubuntu:Pro:24.04:LTS: netty, Ubuntu:Pro:26.04:LTS: netty</p> <p>A flaw was found in Netty&#39;s HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-93562