CPython http.cookiejar can delete other domains' cookies
Python rates CVE-2026-124249 medium: an expired Set-Cookie can remove cookies that belong to other domains.
Stories per day · 30 days
2 RSS
Relatedperl4denial-of-service3chrome2cisco2psgi2request-smuggling2safe-browsing2access-control1apache1clickfix1cloudflare1cookiejar1cookies1cpython1csrf1decompression1eclipse1expressway1
23 stories, newest first · one card per story
Stories tagged #http
Squid mishandles HTTP Transfer-Encoding headers, enabling request smuggling (USN-8998-1)
Squid incorrectly handles certain HTTP Transfer-Encoding headers, allowing HTTP request smuggling, bypassing security mechanisms, or poisoning web caches.
Furl 3.15 fixes memory exhaustion in Perl HTTP decompression
Furl versions through 3.15 allow memory exhaustion via unbounded decompression of HTTP responses (CVE-2026-65059).
Starlet before 0.33 for Perl has request-handling flaws
A large Content-Length can kill a worker, and chunked bodies from 0.20 can exhaust CPU.
Request smuggling in Eclipse Vert.x HTTP/1.x decoder (CVE-2026-102479)
JFrog says vertx-core has about 2,100 Maven dependents, but the exposed window covers only three minor branches.
POST-to-GET interchange found on 407 of Tranco top 10k
Some equivalent GETs accept CSRF tokens rejected on POST and return cacheable responses.
Starman before 0.4019 has four Perl HTTP handling flaws
Named issues include an indefinite worker hold, CPU exhaustion on chunked bodies, and HEAD responses that desynchronize the connection.
HTTP::Server::PSGI before 1.0056 crashes on large Content-Length
One request that declares a large Content-Length can crash the PSGI server; 1.0056 is the fixed release.
Apache Traffic Server fixes multiple flaws in 9.2.16, 10.1.5 and 10.2.1
An oss-security forward of Apache's October 20 note names CVE-2026-111813, but this excerpt omits each flaw's impact.
Chrome now asks permission before insecure HTTP connections
Nearly 95% of desktop users see no HTTP warning in a week; intranet and local IPs are exempt.
Chrome warns on ClickFix clipboard commands and plain HTTP
Server-side Gemini scam checks and ClickFix clipboard warnings are Enhanced Protection features; HTTP prompts are now default for everyone.
Cisco Expressway flaw lets remote attackers read sensitive data
A crafted HTTP request during Mobile and Remote Access provisioning can bypass authorization checks on Expressway-C and Expressway-E.
Cisco Unified CM flaw lets remote attackers bypass access control
Crafted HTTP requests can reach network areas beyond intended access on Unified CM and Unified CM SME; updates exist and workarounds do not.
Cloudflare WAF adds full-transaction detection and response rules
The features are generally available on every plan, including Free, and the first managed rules target php2shell.
1
CVE-2026-104380: Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one
CVE-2026-104380 lets Punk 0.48–0.54 route Extended CONNECT requests to GET routes without an Origin check.
CVE-2026-92609: Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication
Apache Qpid Broker-J through 10.1.0 has a session-fixation flaw in HTTP management authentication.
USN-8811-1: urllib3 vulnerability
Ubuntu fixed an urllib3 flaw that can leak sensitive HTTP headers on cross-origin redirects.
We just shipped support for the ugliest part of HTTP: Vary
Cloudflare now honors HTTP Vary, avoiding HTML and JSON cache mixups.
CVE-2026-77756: Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests
Low-severity Tomcat flaw honors Transfer-Encoding on HTTP/1.0, enabling request smuggling.
The Truth about GET and HTTP Standards, (Tue, Sep 22nd)
SANS research tests Apache, NGINX, and Python server responses to non-standard HTTP GET requests with a body, finding inconsistent handling.
HTTP QUERY Method: The Grey Zone Between GET And POST., (Fri, Sep 18th)
RFC 10008 standardizes the HTTP QUERY method, creating potential WAF inspection bypasses, cache poisoning, and CSRF gaps because most defenses don't recognize the new verb.
1
USN-8780-1: libsoup vulnerabilities
Ubuntu fixed three libsoup flaws enabling HTTP header injection via proxies and leakage of proxy credentials or request data.
CVE-2026-70469: Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests
Apache NiFi CVE-2026-70469: duplicate or non-standard Content-Encoding headers bypass gzip request filtering in NiFi 2.11.0's REST API.