Monthly
Percent-encoded scheme normalization in fast-uri before 2.4.8, in 3.0.0 through 3.1.8, and in 4.0.0 through 4.2.2 can convert an input that raw-string filters consider inert into a live javascript, data, or vbscript URL. Applications that parse, normalize, or resolve a URL with fast-uri, screen dangerous schemes using the raw input, and then store or render the normalized/resolved result-or use equal() for equality-based allowlists-can be exposed to stored or reflected cross-site scripting. Exploitation requires victim interaction (UI:R), and no public exploit identified at time of analysis; KEV status is not indicated.
Remote, unauthenticated data injection into upstream requests affects NGINX Plus and NGINX Open Source deployments that terminate HTTP/3 via the ngx_http_v3_module and have the proxy_request_buffering on directive active on the proxied location. An attacker able to reach such a listener can cause attacker-controlled bytes to be blended into the request forwarded to the backend, an integrity-only problem (CVSS 4.0 base 6.9; independent CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) with no confidentiality loss, no availability loss, and, per F5, no control-plane exposure. Exposure is sharply narrowed because HTTP/3 is not enabled in default nginx builds and exploitation requires both a QUIC listener and request buffering; no public exploit has been identified at time of analysis.
Encoding-handling flaw in Coraza WAF 3.0.0 through 3.7.0 corrupts the output of the t:jsDecode transformation whenever a payload contains JavaScript octal escape sequences, allowing attackers to smuggle XSS or SQL injection syntax past WAF rules that depend on jsDecode for normalization. Because the transformation emits null bytes (and, for high bytes, clamped or saturated values) instead of the real decoded characters, a rule that inspects the transformed value never sees the attack string, while the downstream browser or application does decode it correctly and executes it. The estimated severity is CVSS 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N), exploitation requires that the deployment actually load jsDecode-based rules such as the OWASP CRS and that the protected application itself be vulnerable to the hidden payload; there is no confirmed active exploitation (not listed in CISA KEV), although a reproducible proof-of-concept script does accompany the advisory, and no authentication or user interaction is needed to send the request.
Malformed UTF-8 echoed back through an AMQP shortstr property can permanently disable RPC consumers built on the RabbitMQ Java client before 5.36.0, forcing the affected consumer to fail on every redelivery of a single poison message. An attacker with low-privileged broker access publishes a request whose property value (for example correlation-id) contains invalid UTF-8; ValueReader.readShortstr decodes those bytes into U+FFFD replacement characters, which re-encode to more than the 255-byte AMQP shortstr limit that ValueWriter.writeShortstr enforces, so reply publication throws an unchecked exception. In RpcServer.mainloop() and tutorial-style echo consumers that exception aborts the loop before acknowledgement, the broker requeues the message, and the consumer is stuck until the queue is purged. No public exploit identified at time of analysis; impact is confined to availability of the target consumer (reported CVSS 4.0 base 6.0; assessed CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) with no code execution, authentication bypass, or data exposure.
OpenDMARC through 1.4.2 can mishandle Internationalized Domain Name labels during DMARC policy lookup in opendmarc_policy_query_dmarc, allowing a remote, unauthenticated attacker to trigger an encoding error with a crafted email and potentially distort DMARC evaluation on internet-facing mail servers that run OpenDMARC as a milter/library, typically with Postfix or Sendmail. Publicly available exploit code exists, but the supplied data does not confirm active exploitation or a CISA KEV entry. The independent assessment rates this as a moderate integrity and availability issue rather than a high-urgency compromise: CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L, because the flaw requires an IDN/non-ASCII domain edge case and the practical payoff depends on downstream trust in the DMARC verdict.
The mailto scheme parser added to fast-uri 4.1.3 (and still present in 4.1.4) compares query field names against the reserved names 'to', 'subject' and 'body' while they are still percent-encoded, then decodes them only when storing them as generic headers — so a percent-encoded spelling of a reserved field is invisible to that check but is written back out as the literal field name during serialization. Any application built on Fastify, ajv or similar Node.js stacks that parses a mailto URI, validates, logs or displays the recipient list, and then re-serializes it with fast-uri before sending can be tricked into delivering mail to an attacker-chosen address, with subject and body content smuggled across the same roundtrip. The flaw is rated 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-172 Encoding Error) and is fixed in fast-uri 4.1.5.
Symfony's UrlGenerator encodes only alternating dot-segments in chained `../` or `./` sequences due to a `strtr()` advancement bug, producing URLs that RFC 3986-conformant reverse proxies, API gateways, and HTTP clients collapse to unintended paths. Routes exposing parameters with permissive requirements (`.+`, `.*`) that permit slashes are the exploitable surface when attacker-controlled values contain multiple consecutive dot-segments. No active exploitation is confirmed (not in CISA KEV, no EPSS score assigned), but vendor-confirmed patches are available across all maintained Symfony branches, and the vulnerability shares the same route round-trip integrity class as the previously disclosed CVE-2026-45065.
NGINX Open Source configured to proxy HTTP/2 traffic with proxy_http_version set to 2 combined with proxy_set_body allows remote unauthenticated attackers to inject frame headers and payload bytes to upstream peers, enabling potential header injection or request manipulation attacks. The vulnerability affects default configurations without requiring authentication or user interaction, with CVSS 5.8 indicating moderate integrity impact across networked systems. No public exploit code or active exploitation has been confirmed at this time.
Libmodsecurity is one component of the ModSecurity v3 project. Rated high severity (CVSS 7.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Rated low severity (CVSS 2.4), this vulnerability is remotely exploitable, low attack complexity.
Percent-encoded scheme normalization in fast-uri before 2.4.8, in 3.0.0 through 3.1.8, and in 4.0.0 through 4.2.2 can convert an input that raw-string filters consider inert into a live javascript, data, or vbscript URL. Applications that parse, normalize, or resolve a URL with fast-uri, screen dangerous schemes using the raw input, and then store or render the normalized/resolved result-or use equal() for equality-based allowlists-can be exposed to stored or reflected cross-site scripting. Exploitation requires victim interaction (UI:R), and no public exploit identified at time of analysis; KEV status is not indicated.
Remote, unauthenticated data injection into upstream requests affects NGINX Plus and NGINX Open Source deployments that terminate HTTP/3 via the ngx_http_v3_module and have the proxy_request_buffering on directive active on the proxied location. An attacker able to reach such a listener can cause attacker-controlled bytes to be blended into the request forwarded to the backend, an integrity-only problem (CVSS 4.0 base 6.9; independent CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) with no confidentiality loss, no availability loss, and, per F5, no control-plane exposure. Exposure is sharply narrowed because HTTP/3 is not enabled in default nginx builds and exploitation requires both a QUIC listener and request buffering; no public exploit has been identified at time of analysis.
Encoding-handling flaw in Coraza WAF 3.0.0 through 3.7.0 corrupts the output of the t:jsDecode transformation whenever a payload contains JavaScript octal escape sequences, allowing attackers to smuggle XSS or SQL injection syntax past WAF rules that depend on jsDecode for normalization. Because the transformation emits null bytes (and, for high bytes, clamped or saturated values) instead of the real decoded characters, a rule that inspects the transformed value never sees the attack string, while the downstream browser or application does decode it correctly and executes it. The estimated severity is CVSS 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N), exploitation requires that the deployment actually load jsDecode-based rules such as the OWASP CRS and that the protected application itself be vulnerable to the hidden payload; there is no confirmed active exploitation (not listed in CISA KEV), although a reproducible proof-of-concept script does accompany the advisory, and no authentication or user interaction is needed to send the request.
Malformed UTF-8 echoed back through an AMQP shortstr property can permanently disable RPC consumers built on the RabbitMQ Java client before 5.36.0, forcing the affected consumer to fail on every redelivery of a single poison message. An attacker with low-privileged broker access publishes a request whose property value (for example correlation-id) contains invalid UTF-8; ValueReader.readShortstr decodes those bytes into U+FFFD replacement characters, which re-encode to more than the 255-byte AMQP shortstr limit that ValueWriter.writeShortstr enforces, so reply publication throws an unchecked exception. In RpcServer.mainloop() and tutorial-style echo consumers that exception aborts the loop before acknowledgement, the broker requeues the message, and the consumer is stuck until the queue is purged. No public exploit identified at time of analysis; impact is confined to availability of the target consumer (reported CVSS 4.0 base 6.0; assessed CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) with no code execution, authentication bypass, or data exposure.
OpenDMARC through 1.4.2 can mishandle Internationalized Domain Name labels during DMARC policy lookup in opendmarc_policy_query_dmarc, allowing a remote, unauthenticated attacker to trigger an encoding error with a crafted email and potentially distort DMARC evaluation on internet-facing mail servers that run OpenDMARC as a milter/library, typically with Postfix or Sendmail. Publicly available exploit code exists, but the supplied data does not confirm active exploitation or a CISA KEV entry. The independent assessment rates this as a moderate integrity and availability issue rather than a high-urgency compromise: CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L, because the flaw requires an IDN/non-ASCII domain edge case and the practical payoff depends on downstream trust in the DMARC verdict.
The mailto scheme parser added to fast-uri 4.1.3 (and still present in 4.1.4) compares query field names against the reserved names 'to', 'subject' and 'body' while they are still percent-encoded, then decodes them only when storing them as generic headers — so a percent-encoded spelling of a reserved field is invisible to that check but is written back out as the literal field name during serialization. Any application built on Fastify, ajv or similar Node.js stacks that parses a mailto URI, validates, logs or displays the recipient list, and then re-serializes it with fast-uri before sending can be tricked into delivering mail to an attacker-chosen address, with subject and body content smuggled across the same roundtrip. The flaw is rated 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-172 Encoding Error) and is fixed in fast-uri 4.1.5.
Symfony's UrlGenerator encodes only alternating dot-segments in chained `../` or `./` sequences due to a `strtr()` advancement bug, producing URLs that RFC 3986-conformant reverse proxies, API gateways, and HTTP clients collapse to unintended paths. Routes exposing parameters with permissive requirements (`.+`, `.*`) that permit slashes are the exploitable surface when attacker-controlled values contain multiple consecutive dot-segments. No active exploitation is confirmed (not in CISA KEV, no EPSS score assigned), but vendor-confirmed patches are available across all maintained Symfony branches, and the vulnerability shares the same route round-trip integrity class as the previously disclosed CVE-2026-45065.
NGINX Open Source configured to proxy HTTP/2 traffic with proxy_http_version set to 2 combined with proxy_set_body allows remote unauthenticated attackers to inject frame headers and payload bytes to upstream peers, enabling potential header injection or request manipulation attacks. The vulnerability affects default configurations without requiring authentication or user interaction, with CVSS 5.8 indicating moderate integrity impact across networked systems. No public exploit code or active exploitation has been confirmed at this time.
Libmodsecurity is one component of the ModSecurity v3 project. Rated high severity (CVSS 7.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Rated low severity (CVSS 2.4), this vulnerability is remotely exploitable, low attack complexity.