CVE-2026-93711: Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array
Dancer2 before 2.2.0 leaves CR and LF in response header names, enabling header injection.
Stories per day · 30 days
1 RSS
4 stories, newest first · one card per story
Stories tagged #header-injection
Critical pgAdmin Authentication Bypass Lets Attackers Login as Administrator Without Credentials
pgAdmin 4 versions 6.2-9.17 contain critical auth bypass CVE-2026-86863 (CVSS 9.8) letting unauthenticated attackers impersonate administrators; fixed in 9.18.
3
USN-8780-1: libsoup vulnerabilities
Ubuntu fixed three libsoup flaws enabling HTTP header injection via proxies and leakage of proxy credentials or request data.
[20260801] - Core - Response header injection in download views
Joomla fixes CVE-2026-71572, response header injection in download views enabling reflected file download attacks, in 5.4.8/6.1.3.