Search: “content-encoding”

CVE-2026-70469: Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests

Apache NiFi CVE-2026-70469: duplicate or non-standard Content-Encoding headers bypass gzip request filtering in NiFi 2.11.0's REST API.

Apache NiFi disclosed CVE-2026-70469, rated High, affecting the Jetty-based REST API module (org.apache.nifi:nifi-jetty) in version 2.11.0. NiFi 2.11.0 disabled gzip-encoded HTTP requests and rejects those carrying the standard Content-Encoding header, but the framework enforcement filter fails to check multiple instances of the header and does not reject non-standard gzip identifiers, allowing crafted requests to evade the check. The disclosure was posted to oss-security by David Handermann.

oss-security·15:13 UTC · 7h agoVulnerabilityCVE-2026-70469

Content-Encoding WAF Evasion

FortiWeb WAF policies can be bypassed by unauthenticated attackers using crafted Content-Encoding requests (CVSS 4.8).

Fortinet disclosed an incomplete list of disallowed inputs (CWE-184) in FortiWeb's WAF, tracked as FG-IR-26-157. An unauthenticated attacker can bypass WAF policies using specifically crafted requests with crafted Content-Encoding values. The issue carries a CVSSv3 score of 4.8 and was revised on 2026-08-12. The advisory does not report active exploitation.

Fortinet PSIRT·Aug 12, 07:00 UTC · Aug 12, 2026Advisory

CISA: Patch actively exploited SolarWinds Serv-U DoS vulnerability (CVE-2026-28318)

Help Net Security·Jun 8, 00:00 UTC · Jun 8, 2026Vulnerability in the wildCVE-2026-28318CVE-2021-35211CVE-2021-35247+1 CVEs

U.S. CISA adds SolarWinds Serv-U flaw to its Known Exploited Vulnerabilities catalog

Security Affairs·Jun 6, 21:45 UTC · Jun 6, 2026Exploit / PoC in the wildCVE-2026-28318

CISA Adds Actively Exploited SolarWinds Serv

The Hacker News·Jun 6, 08:14 UTC · Jun 6, 2026Advisory in the wildCVE-2026-28318

SWEED targets precision engineering companies in Italy

Security Affairs·Oct 28, 09:53 UTC · Oct 28, 2019VulnerabilityCVE-2017-11882