Search Vulnerabilities

Libsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()

Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests

Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections

Eclipse Grizzly in versions before 5

HTTP Request Smuggling in SAP Approuter

OpenVPN Access Server 2

Inconsistent Interpretation of HTTP Requests in CICS Transaction Gateway for Multiplatforms.

IBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerability

HTTP/2 Stream Parser Confusion Body-Inspection Bypass in AWS Application Load Balancer with AWS WAF

HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF

nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length

Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length

Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

vLLM: OpenAI auth bypass

Python-Multipart: Semicolon treated as querystring field separator enables parameter smuggling

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling

Tinyproxy - HTTP Request Smuggling via Duplicate Content-Length Headers

Tinyproxy - HTTP Request Smuggling via CL/TE Desynchronization

Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted