Monthly
Echo's Proxy middleware can forward later HTTP requests straight to the configured upstream without invoking Echo's router or route-specific middleware after a client WebSocket upgrade is rejected by that upstream with an ordinary keep-alive response. This affects Echo v4 releases from 4.0.0 through 4.16.0 and v5 releases from 5.0.0 through 5.4.0, and can let unauthenticated remote attackers reach upstream resources that rely solely on Echo route-level authentication or authorization. Exploitation is conditional-it needs a reachable proxy route, an upstream that keeps the connection alive after rejecting the upgrade, and a target with no independent upstream authorization-so the independent assessment rates it high severity with high attack complexity; fixed releases are 4.16.1 and 5.4.1, and no public exploit or CISA KEV entry was identified at time of analysis.
GitLab CE/EE versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 can redirect certain OAuth/OIDC flows to an externally controlled server when an unauthenticated attacker poisons a shared cache of discovery documents; exploitation is high-complexity and requires a legitimate user to subsequently start an affected flow (UI:R). The issue is rated CVSS 7.5 with scope change and high confidentiality impact, but no public exploit identified at time of analysis and CISA KEV status was not indicated, making this a moderate-priority fix rather than an emergency. Patched releases 19.3.6, 19.4.3, and 19.5.1 are available.
Response-framing desync in Apache Traffic Server (8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0) allows a malformed 302 response that should have been rejected as a parse error to pass the rejection path through the Transfer-Encoding: chunked carve-out, so the proxy stores and serves a response that different peers interpret differently. Per the CVSS vector the issue is remote and unauthenticated (AV:N/AC:L/PR:N/UI:N, scope changed, I:H/C:L), enabling cache poisoning and response-framing desync against deployments acting as caching or forwarding proxies. No public exploit code or CISA KEV entry is associated at time of analysis; the practical precondition is that a suitable malformed upstream response actually traverses the proxy. Fixed versions 9.2.16, 10.1.5, and 10.2.1 are published by the vendor.
Unauthenticated remote attackers can abort Apache bRPC 1.17.0 and earlier servers that expose HTTP/2 or gRPC (h2) listeners by sending a header block that fills the HPACK dynamic table's ring buffer without triggering byte-based eviction. The flaw is a slot-accounting mismatch in the HPACK decoder: the default 4096-byte table is provisioned for 34-byte entries, but 33-byte minimal entries permit 121 insertions before the fixed-size ring buffer overflows, tripping CHECK(!_header_queue.full()) and terminating the process. No public exploit code was identified at time of analysis; the independent assessment rates this CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), availability-only, with exploitation requiring only network reachability to a default-configured h2/gRPC port because HPACK decoding occurs before any Authenticator check.
Authorization bypass in Cloudflare Pingora before 0.9.0 can occur only in a chained HTTP/1 deployment where Pingora forwards to a downstream HTTP/1 intermediary that honors Connection-nominated headers and the origin trusts a header Pingora adds, such as X-Forwarded-For. A remote, unauthenticated attacker can use the client Connection header to nominate that trusted header; because the vulnerable HTTP/1 upstream path fails to strip hop-by-hop or nominated headers, the intermediary may remove it and bypass IP-based authorization. No public exploit was identified at time of analysis, Cloudflare CDN customers are explicitly unaffected, and 0.9.0+ default policy removes these headers, so the issue is conditional rather than broadly exploitable.
HTTP request smuggling in Eclipse Vert.x (io.vertx:vertx-core) affects versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, where the HTTP/1.x decoder canonicalizes well-known header names in a way that lets crafted names such as 'Content-Xength' be treated as 'Content-Length'. Unauthenticated remote attackers (CVSS v4.0 vector PR:N/UI:N, score 8.7; independent CVSS v3.1 assessment AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) can exploit this to desynchronize how HTTP messages are framed, with integrity impact only and no direct confidentiality or availability loss. Practical impact depends on deployment topology: a second HTTP agent (front-end proxy, load balancer, CDN or back-end server) must share the request path and parse the ambiguous headers differently from Vert.x, whereas a standalone Vert.x HTTP/1.x server with no co-located intermediary sharply limits exploitability; HTTP/2-only deployments are not reached by this decoder path. No public exploit identified at time of analysis, and no confirmed CISA KEV active exploitation.
Path-restriction bypass in BusyBox httpd's reverse proxy feature allows unauthenticated remote attackers to reach backend paths outside the configured forwarding prefix. When URL-prefix proxying is configured, only the first request on a TCP connection has its path rewritten; a pipelined second request is relayed verbatim, defeating the intended prefix restriction and exposing arbitrary backend routes. Affects BusyBox httpd deployments, including Red Hat Hardened Images, that enable the non-default reverse proxy directive; no public exploit identified at time of analysis. CVSS 3.1 base score 7.2 (High) reflects network reachability, low complexity, no privileges or user interaction, and changed scope impacting the proxied backend.
Request smuggling in the ASP.NET Core Kestrel HTTP/1 server lets a remote, unauthenticated attacker desynchronize HTTP request parsing and tamper with how requests are interpreted by the server and any shared front-end proxy, load balancer, or connection pool. The flaw is triggered when a Kestrel HTTP/1 connection carrying unread request-body bytes is aborted and Kestrel reparses that leftover data as a new request; the vendor rates it Critical at CVSS 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), while the independent assessment applies the same impact but rates attack complexity as High because the abort/timing prerequisite must be met, and the practical blast radius is greatest where connections are reused across tenants. Affected runtimes are ASP.NET Core 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13, and 11.0 before 11.0.0-rc.2, plus Microsoft Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4; a vendor patch is available and there is no public exploit identified at time of analysis.
HTTP request smuggling in ASP.NET Core's Kestrel web server allows unauthenticated remote attackers to desynchronize request parsing and bypass security features by having Kestrel accept newline characters in HTTP/2 request trailers and in values drawn from the dynamic HPACK table rather than rejecting them as malformed. All supported ASP.NET Core release trains are exposed - 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13, and 11.0 before 11.0.0-rc.2 - along with bundled Visual Studio 2022 17.14 (<17.14.42) and Visual Studio 2026 18.10 (<18.10.4); realistic impact is highest where a proxy, load balancer, or chained server sits in front of Kestrel and performs its own HTTP/2 parsing. The flaw carries a critical CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and is rated with total technical impact under CISA SSVC, but exploitation has not been observed (SSVC Exploitation: none) and no public exploit code has been identified at time of analysis.
Request smuggling in the Go net/http standard library occurs when an application handler answers an HTTP/1 CONNECT request with a 2xx status and then returns without hijacking the connection, causing the server to keep parsing HTTP requests on a connection that an intermediate proxy now treats as an opaque tunnel. Affected builds are net/http before 1.26.9 and the 1.27.x line before 1.27.2 (CWE-444, parser disagreement between proxy and origin server). Exploitation requires a non-default handler pattern plus a fronting proxy, so despite the published CVSS base of 7.5 the assessed real-world priority is moderate-to-low; no public exploit code has been identified at time of analysis, EPSS is 0.18% (7th percentile), and CISA SSVC records Exploitation: none with Technical Impact: partial.
Echo's Proxy middleware can forward later HTTP requests straight to the configured upstream without invoking Echo's router or route-specific middleware after a client WebSocket upgrade is rejected by that upstream with an ordinary keep-alive response. This affects Echo v4 releases from 4.0.0 through 4.16.0 and v5 releases from 5.0.0 through 5.4.0, and can let unauthenticated remote attackers reach upstream resources that rely solely on Echo route-level authentication or authorization. Exploitation is conditional-it needs a reachable proxy route, an upstream that keeps the connection alive after rejecting the upgrade, and a target with no independent upstream authorization-so the independent assessment rates it high severity with high attack complexity; fixed releases are 4.16.1 and 5.4.1, and no public exploit or CISA KEV entry was identified at time of analysis.
GitLab CE/EE versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 can redirect certain OAuth/OIDC flows to an externally controlled server when an unauthenticated attacker poisons a shared cache of discovery documents; exploitation is high-complexity and requires a legitimate user to subsequently start an affected flow (UI:R). The issue is rated CVSS 7.5 with scope change and high confidentiality impact, but no public exploit identified at time of analysis and CISA KEV status was not indicated, making this a moderate-priority fix rather than an emergency. Patched releases 19.3.6, 19.4.3, and 19.5.1 are available.
Response-framing desync in Apache Traffic Server (8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0) allows a malformed 302 response that should have been rejected as a parse error to pass the rejection path through the Transfer-Encoding: chunked carve-out, so the proxy stores and serves a response that different peers interpret differently. Per the CVSS vector the issue is remote and unauthenticated (AV:N/AC:L/PR:N/UI:N, scope changed, I:H/C:L), enabling cache poisoning and response-framing desync against deployments acting as caching or forwarding proxies. No public exploit code or CISA KEV entry is associated at time of analysis; the practical precondition is that a suitable malformed upstream response actually traverses the proxy. Fixed versions 9.2.16, 10.1.5, and 10.2.1 are published by the vendor.
Unauthenticated remote attackers can abort Apache bRPC 1.17.0 and earlier servers that expose HTTP/2 or gRPC (h2) listeners by sending a header block that fills the HPACK dynamic table's ring buffer without triggering byte-based eviction. The flaw is a slot-accounting mismatch in the HPACK decoder: the default 4096-byte table is provisioned for 34-byte entries, but 33-byte minimal entries permit 121 insertions before the fixed-size ring buffer overflows, tripping CHECK(!_header_queue.full()) and terminating the process. No public exploit code was identified at time of analysis; the independent assessment rates this CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), availability-only, with exploitation requiring only network reachability to a default-configured h2/gRPC port because HPACK decoding occurs before any Authenticator check.
Authorization bypass in Cloudflare Pingora before 0.9.0 can occur only in a chained HTTP/1 deployment where Pingora forwards to a downstream HTTP/1 intermediary that honors Connection-nominated headers and the origin trusts a header Pingora adds, such as X-Forwarded-For. A remote, unauthenticated attacker can use the client Connection header to nominate that trusted header; because the vulnerable HTTP/1 upstream path fails to strip hop-by-hop or nominated headers, the intermediary may remove it and bypass IP-based authorization. No public exploit was identified at time of analysis, Cloudflare CDN customers are explicitly unaffected, and 0.9.0+ default policy removes these headers, so the issue is conditional rather than broadly exploitable.
HTTP request smuggling in Eclipse Vert.x (io.vertx:vertx-core) affects versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, where the HTTP/1.x decoder canonicalizes well-known header names in a way that lets crafted names such as 'Content-Xength' be treated as 'Content-Length'. Unauthenticated remote attackers (CVSS v4.0 vector PR:N/UI:N, score 8.7; independent CVSS v3.1 assessment AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) can exploit this to desynchronize how HTTP messages are framed, with integrity impact only and no direct confidentiality or availability loss. Practical impact depends on deployment topology: a second HTTP agent (front-end proxy, load balancer, CDN or back-end server) must share the request path and parse the ambiguous headers differently from Vert.x, whereas a standalone Vert.x HTTP/1.x server with no co-located intermediary sharply limits exploitability; HTTP/2-only deployments are not reached by this decoder path. No public exploit identified at time of analysis, and no confirmed CISA KEV active exploitation.
Path-restriction bypass in BusyBox httpd's reverse proxy feature allows unauthenticated remote attackers to reach backend paths outside the configured forwarding prefix. When URL-prefix proxying is configured, only the first request on a TCP connection has its path rewritten; a pipelined second request is relayed verbatim, defeating the intended prefix restriction and exposing arbitrary backend routes. Affects BusyBox httpd deployments, including Red Hat Hardened Images, that enable the non-default reverse proxy directive; no public exploit identified at time of analysis. CVSS 3.1 base score 7.2 (High) reflects network reachability, low complexity, no privileges or user interaction, and changed scope impacting the proxied backend.
Request smuggling in the ASP.NET Core Kestrel HTTP/1 server lets a remote, unauthenticated attacker desynchronize HTTP request parsing and tamper with how requests are interpreted by the server and any shared front-end proxy, load balancer, or connection pool. The flaw is triggered when a Kestrel HTTP/1 connection carrying unread request-body bytes is aborted and Kestrel reparses that leftover data as a new request; the vendor rates it Critical at CVSS 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), while the independent assessment applies the same impact but rates attack complexity as High because the abort/timing prerequisite must be met, and the practical blast radius is greatest where connections are reused across tenants. Affected runtimes are ASP.NET Core 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13, and 11.0 before 11.0.0-rc.2, plus Microsoft Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4; a vendor patch is available and there is no public exploit identified at time of analysis.
HTTP request smuggling in ASP.NET Core's Kestrel web server allows unauthenticated remote attackers to desynchronize request parsing and bypass security features by having Kestrel accept newline characters in HTTP/2 request trailers and in values drawn from the dynamic HPACK table rather than rejecting them as malformed. All supported ASP.NET Core release trains are exposed - 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13, and 11.0 before 11.0.0-rc.2 - along with bundled Visual Studio 2022 17.14 (<17.14.42) and Visual Studio 2026 18.10 (<18.10.4); realistic impact is highest where a proxy, load balancer, or chained server sits in front of Kestrel and performs its own HTTP/2 parsing. The flaw carries a critical CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and is rated with total technical impact under CISA SSVC, but exploitation has not been observed (SSVC Exploitation: none) and no public exploit code has been identified at time of analysis.
Request smuggling in the Go net/http standard library occurs when an application handler answers an HTTP/1 CONNECT request with a 2xx status and then returns without hijacking the connection, causing the server to keep parsing HTTP requests on a connection that an intermediate proxy now treats as an opaque tunnel. Affected builds are net/http before 1.26.9 and the 1.27.x line before 1.27.2 (CWE-444, parser disagreement between proxy and origin server). Exploitation requires a non-default handler pattern plus a fronting proxy, so despite the published CVSS base of 7.5 the assessed real-world priority is moderate-to-low; no public exploit code has been identified at time of analysis, EPSS is 0.18% (7th percentile), and CISA SSVC records Exploitation: none with Technical Impact: partial.