Monthly
HTTP/1.1 request smuggling in http4s blaze allows a remote client to desynchronize message boundaries between blaze's hand-written Java wire parser and a fronting proxy, enabling front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. All deployments of blaze prior to 0.23.18, and the 1.0.0 milestone line from 1.0.0-M1 through 1.0.0-M41, are affected via five independent parser laxities that are reachable from a default BlazeServerBuilder with no non-default configuration. Exploitation is not confirmed in the wild and no public exploit code was identified at time of analysis; CISA SSVC records exploitation as none and automatable as no, and no EPSS score was supplied with the source data.
HTTP/1 request-target parsing in Traefik prior to 2.11.57 and 3.7.13 allows unauthenticated remote attackers to send a rootless URL target (e.g., `http:example.com/admin`) that Go's HTTP library stores in URL.Opaque rather than URL.Path, leaving URL.Path empty. Traefik's routing engine, forwardAuth middleware, and access logger all evaluate against the normalized empty path (treated as `/`), while URL.RequestURI() gives URL.Opaque precedence when forwarding — meaning the backend receives the original opaque target verbatim. The practical consequence is cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion, all requiring no authentication or special client configuration. No public exploit has been identified at time of analysis, though the patch PR includes test cases demonstrating the attack technique in full detail.
Security middleware bypass in Traefik reverse proxy versions 2.11.26-2.11.56 and 3.4.2-3.7.12 allows unauthenticated network attackers to reach protected backend routes by exploiting h2c protocol upgrade tunneling. When a crafted HTTP/1.1 request carrying Connection, Upgrade: h2c, and HTTP2-Settings headers causes a h2c-capable backend to respond with 101 Switching Protocols, Traefik enters a raw TCP tunnel that silently disables every configured middleware layer-including BasicAuth, ForwardAuth, IPAllowList, RateLimit, and all access logging, metrics, and tracing hooks-for the lifetime of that connection. All subsequent HTTP/2 frames in the tunnel reach protected backend paths without any Traefik security enforcement. No public exploit code has been identified at time of analysis; vendor-released fixes are available in v2.11.57 and v3.7.13.
We need answer JSON only. Need analyze CVE. Need comply with fields. Need use all data. Need be careful. We need synthesize. Let's parse input. CVE-2026-68006: Description: An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file. CVSS 9.1 Vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. CWE-444. EPSS 0.17 percentile 6. Reported by mitre. CPE cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*. Tags: RCE, Request Smuggling, N A. ENVD. Affected versions: n/a n/a. References: github issue, nvd. No KEV mentioned. POC? No explicit. Patch? Description says before v8.0.3, so likely fixed in 8.0.3? Need infer: "v.5.0.0 and before v.8.0.3" means affected 5.0.0 through before 8.0.3? Wording maybe "Puma v.5.0.0 and before v.8.0.3" maybe affected versions 5.0.0 to <8.0.3? Actually says v.5.0.0 and before v.8.0.3. Likely fixed in 8.0.3. Need state patch exact fix 8.0.3. Need check references. We have GitHub issue maybe patch? We can say vendor-released patch 8.0.3? The description says before v.8.0.3 allows, so 8.0.3 is fixed. But no official vendor advisory in references except NVD. Need not invent. But can say "Vendor-released patch: 8.0.3 (per version range in description)". Need maybe product_name "Puma". Summary original not copy description. Need include no active exploitation confirmed, POC not identified? Public exploit? Description mention GitHub issue maybe issue, could be a public report. We must use all. Need respect "inowroclaw" in risk_assessment only lowercase, once. Need weave naturally. Example: "... even a mid-sized municipal IT team in inowroclaw should treat this as urgent ...". Must not factual. Need maybe include. Need provide JSON object. Ensure all fields strings. data_quality_flags array. Could include flags maybe tags include "N A" which is meaningless? Also CPE vendor n/a product n/a. Maybe data quality flags? Need consider. CPE is generic cpe:2.3:a:n/a:n/a. Tags include "N A" maybe wrong? Coul
HTTP request smuggling in Visual Studio Code (versions 1.0.0 through 1.136.2) enables unauthenticated network attackers to bypass security controls through inconsistent interpretation of HTTP request boundaries. The CVSS scope change (S:C) signals that impact extends beyond the editor itself - smuggled requests can affect back-end services or proxies that VS Code communicates with, resulting in high confidentiality exposure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, unauthenticated nature of the attack surface warrants prompt patching.
HTTP/1.1 request smuggling in Eclipse Jetty allows unauthenticated remote attackers to desynchronize request boundary parsing between Jetty and an upstream proxy, enabling manipulation of other users' HTTP sessions. The root cause is Jetty's acceptance of a bare LF character (\n) as a line terminator during chunked transfer encoding parsing - specifically in chunk extensions, chunk data termination, or trailer termination - where RFC 7230 mandates CRLF (\r\n). Depending on the Jetty version and configured HTTP compliance mode, a crafted request can cause the proxy and Jetty to disagree on where one request ends and the next begins, enabling request injection against co-located tenants. No public exploit has been identified at time of analysis.
Request smuggling in Erlang OTP inets (versions 17.0 through 29.x) arises when the httpd server sits behind a Content-Length-preferring reverse proxy: inets frames the request body by chunked Transfer-Encoding and silently discards a co-present Content-Length header, while the front-end proxies request boundaries by Content-Length, producing a classic CL.TE desync. An unauthenticated network attacker in this topology can inject a crafted prefix into a subsequent victim's HTTP request, potentially enabling session hijacking, credential theft, or cache poisoning against other users of the same back-end. No public exploit has been identified at time of analysis, the vulnerability is not listed in CISA KEV, and vendor patches are available for the OTP 27.x, 28.x, and 29.x release branches.
Remote unauthenticated attackers can exploit Erlang/OTP's built-in inets HTTP server across OTP versions 22.2 through 29.0 to conduct HTTP Request Smuggling by sending headers with whitespace before the colon - a malformed construct the server silently discarded rather than rejecting as mandated by RFC 7230 Section 3.2.4. When inets is deployed behind a front-end proxy or load balancer that interprets such headers differently, the resulting parsing discordance creates a desynchronized request boundary exploitable for session hijacking, authentication bypass, or cache poisoning. No public exploit has been identified at time of analysis; vendor-released patches are available across all three affected OTP release branches.
HTTP request smuggling in Erlang/OTP's built-in inets httpd server allows unauthenticated remote attackers to inject arbitrary HTTP headers and poison request pipelines in deployments fronted by a reverse proxy. The root cause is a longstanding absence of obs-fold support: any CRLF followed by a whitespace octet (SP or TAB) is silently parsed as a new header rather than a header continuation, causing proxy-backend disagreement on request boundaries. Affected versions span OTP 17.0 through the patched releases (27.3.4.17, 28.5.0.6, 29.0.6), with vendor patches now available via the Erlang GitHub security advisory. No public exploit code or CISA KEV listing exists at time of analysis.
Response poisoning in Apache APISIX 2.12.0 through 3.17.0 enables remote attackers to manipulate the gateway's serverless plugin routes so that victims receive attacker-chosen content or other authenticated users' API responses. The root cause is inconsistent HTTP request boundary interpretation - the defining characteristic of HTTP Request/Response Smuggling - applied within APISIX's serverless plugin execution pipeline. No public exploit has been identified at time of analysis, and vendor-released patch version 3.18.0 is available.
HTTP/1.1 request smuggling in http4s blaze allows a remote client to desynchronize message boundaries between blaze's hand-written Java wire parser and a fronting proxy, enabling front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. All deployments of blaze prior to 0.23.18, and the 1.0.0 milestone line from 1.0.0-M1 through 1.0.0-M41, are affected via five independent parser laxities that are reachable from a default BlazeServerBuilder with no non-default configuration. Exploitation is not confirmed in the wild and no public exploit code was identified at time of analysis; CISA SSVC records exploitation as none and automatable as no, and no EPSS score was supplied with the source data.
HTTP/1 request-target parsing in Traefik prior to 2.11.57 and 3.7.13 allows unauthenticated remote attackers to send a rootless URL target (e.g., `http:example.com/admin`) that Go's HTTP library stores in URL.Opaque rather than URL.Path, leaving URL.Path empty. Traefik's routing engine, forwardAuth middleware, and access logger all evaluate against the normalized empty path (treated as `/`), while URL.RequestURI() gives URL.Opaque precedence when forwarding — meaning the backend receives the original opaque target verbatim. The practical consequence is cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion, all requiring no authentication or special client configuration. No public exploit has been identified at time of analysis, though the patch PR includes test cases demonstrating the attack technique in full detail.
Security middleware bypass in Traefik reverse proxy versions 2.11.26-2.11.56 and 3.4.2-3.7.12 allows unauthenticated network attackers to reach protected backend routes by exploiting h2c protocol upgrade tunneling. When a crafted HTTP/1.1 request carrying Connection, Upgrade: h2c, and HTTP2-Settings headers causes a h2c-capable backend to respond with 101 Switching Protocols, Traefik enters a raw TCP tunnel that silently disables every configured middleware layer-including BasicAuth, ForwardAuth, IPAllowList, RateLimit, and all access logging, metrics, and tracing hooks-for the lifetime of that connection. All subsequent HTTP/2 frames in the tunnel reach protected backend paths without any Traefik security enforcement. No public exploit code has been identified at time of analysis; vendor-released fixes are available in v2.11.57 and v3.7.13.
We need answer JSON only. Need analyze CVE. Need comply with fields. Need use all data. Need be careful. We need synthesize. Let's parse input. CVE-2026-68006: Description: An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file. CVSS 9.1 Vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. CWE-444. EPSS 0.17 percentile 6. Reported by mitre. CPE cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*. Tags: RCE, Request Smuggling, N A. ENVD. Affected versions: n/a n/a. References: github issue, nvd. No KEV mentioned. POC? No explicit. Patch? Description says before v8.0.3, so likely fixed in 8.0.3? Need infer: "v.5.0.0 and before v.8.0.3" means affected 5.0.0 through before 8.0.3? Wording maybe "Puma v.5.0.0 and before v.8.0.3" maybe affected versions 5.0.0 to <8.0.3? Actually says v.5.0.0 and before v.8.0.3. Likely fixed in 8.0.3. Need state patch exact fix 8.0.3. Need check references. We have GitHub issue maybe patch? We can say vendor-released patch 8.0.3? The description says before v.8.0.3 allows, so 8.0.3 is fixed. But no official vendor advisory in references except NVD. Need not invent. But can say "Vendor-released patch: 8.0.3 (per version range in description)". Need maybe product_name "Puma". Summary original not copy description. Need include no active exploitation confirmed, POC not identified? Public exploit? Description mention GitHub issue maybe issue, could be a public report. We must use all. Need respect "inowroclaw" in risk_assessment only lowercase, once. Need weave naturally. Example: "... even a mid-sized municipal IT team in inowroclaw should treat this as urgent ...". Must not factual. Need maybe include. Need provide JSON object. Ensure all fields strings. data_quality_flags array. Could include flags maybe tags include "N A" which is meaningless? Also CPE vendor n/a product n/a. Maybe data quality flags? Need consider. CPE is generic cpe:2.3:a:n/a:n/a. Tags include "N A" maybe wrong? Coul
HTTP request smuggling in Visual Studio Code (versions 1.0.0 through 1.136.2) enables unauthenticated network attackers to bypass security controls through inconsistent interpretation of HTTP request boundaries. The CVSS scope change (S:C) signals that impact extends beyond the editor itself - smuggled requests can affect back-end services or proxies that VS Code communicates with, resulting in high confidentiality exposure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, unauthenticated nature of the attack surface warrants prompt patching.
HTTP/1.1 request smuggling in Eclipse Jetty allows unauthenticated remote attackers to desynchronize request boundary parsing between Jetty and an upstream proxy, enabling manipulation of other users' HTTP sessions. The root cause is Jetty's acceptance of a bare LF character (\n) as a line terminator during chunked transfer encoding parsing - specifically in chunk extensions, chunk data termination, or trailer termination - where RFC 7230 mandates CRLF (\r\n). Depending on the Jetty version and configured HTTP compliance mode, a crafted request can cause the proxy and Jetty to disagree on where one request ends and the next begins, enabling request injection against co-located tenants. No public exploit has been identified at time of analysis.
Request smuggling in Erlang OTP inets (versions 17.0 through 29.x) arises when the httpd server sits behind a Content-Length-preferring reverse proxy: inets frames the request body by chunked Transfer-Encoding and silently discards a co-present Content-Length header, while the front-end proxies request boundaries by Content-Length, producing a classic CL.TE desync. An unauthenticated network attacker in this topology can inject a crafted prefix into a subsequent victim's HTTP request, potentially enabling session hijacking, credential theft, or cache poisoning against other users of the same back-end. No public exploit has been identified at time of analysis, the vulnerability is not listed in CISA KEV, and vendor patches are available for the OTP 27.x, 28.x, and 29.x release branches.
Remote unauthenticated attackers can exploit Erlang/OTP's built-in inets HTTP server across OTP versions 22.2 through 29.0 to conduct HTTP Request Smuggling by sending headers with whitespace before the colon - a malformed construct the server silently discarded rather than rejecting as mandated by RFC 7230 Section 3.2.4. When inets is deployed behind a front-end proxy or load balancer that interprets such headers differently, the resulting parsing discordance creates a desynchronized request boundary exploitable for session hijacking, authentication bypass, or cache poisoning. No public exploit has been identified at time of analysis; vendor-released patches are available across all three affected OTP release branches.
HTTP request smuggling in Erlang/OTP's built-in inets httpd server allows unauthenticated remote attackers to inject arbitrary HTTP headers and poison request pipelines in deployments fronted by a reverse proxy. The root cause is a longstanding absence of obs-fold support: any CRLF followed by a whitespace octet (SP or TAB) is silently parsed as a new header rather than a header continuation, causing proxy-backend disagreement on request boundaries. Affected versions span OTP 17.0 through the patched releases (27.3.4.17, 28.5.0.6, 29.0.6), with vendor patches now available via the Erlang GitHub security advisory. No public exploit code or CISA KEV listing exists at time of analysis.
Response poisoning in Apache APISIX 2.12.0 through 3.17.0 enables remote attackers to manipulate the gateway's serverless plugin routes so that victims receive attacker-chosen content or other authenticated users' API responses. The root cause is inconsistent HTTP request boundary interpretation - the defining characteristic of HTTP Request/Response Smuggling - applied within APISIX's serverless plugin execution pipeline. No public exploit has been identified at time of analysis, and vendor-released patch version 3.18.0 is available.