Squid mishandles HTTP Transfer-Encoding headers, enabling request smuggling (USN-8998-1)
Squid incorrectly handles certain HTTP Transfer-Encoding headers, allowing HTTP request smuggling, bypassing security mechanisms, or poisoning web caches.
Stories per day · 30 days
1 RSS
6 stories, newest first · one card per story
Stories tagged #request-smuggling
Request smuggling in Eclipse Vert.x HTTP/1.x decoder (CVE-2026-102479)
JFrog says vertx-core has about 2,100 Maven dependents, but the exposed window covers only three minor branches.
Ubuntu Squid flaws allow request smuggling and cache crashes
CVE-2026-61642 can smuggle requests or poison caches; a separate digest bug crashes older Ubuntu releases.
Citrix Patches Critical Zero Days Under Active Exploitation
Citrix patched two actively exploited critical NetScaler zero-days enabling unauthenticated remote code execution.
CVE-2026-86350: Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up
A Tomcat regression of the CVE-2026-41293 fix can mix HTTP/2 request headers.
'HTTP Terminator' Hunts for Novel Desync Attacks
PortSwigger's James Kettle discusses HTTP Terminator, an AI-powered open source tool that uncovered new HTTP request-smuggling (desync) techniques.