Alertas de Seguridad de la Información

M Alto vulnerabilidad

01/10/2026

[CVE-2026-63718] Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling …

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.68.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100666] Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and…

Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod() once per response, including for 1xx informational responses. If a client pipelines an HTTP/1.1 GET carrying an Expect: 100-continue header followed by a HEAD request, the 100 …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-86350] Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in …

Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122,…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-73548] Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36…

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete HTTP/1.1 request in extended CONNECT data; Envoy downgrades the request, writes the data unframed to a keep-…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93569] HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target…

HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-69217] Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/1.1 pars…

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/1.1 parser accepts differing duplicate Content-Length headers and uses the last value instead of rejecting the message. When an Ember server is behind a keep-alive intermediary that selects a different occurrence, an unauthenticated attacker can create CL.CL request smuggling that bypasses front-end control…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-69205] Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HeaderP.parse…

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HeaderP.parse uses a case-sensitive substring test for the Transfer-Encoding value and decodes header bytes with the platform default charset. Values such as Chunked are not recognized, values such as notchunked are incorrectly accepted, and Unicode case folding can turn a Kelvin-sign byte sequence into a match …

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2024-14029] Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as havi…

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2023-54397] Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Con…

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-73494] blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0…

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a different request boundary than a stricter fronting intermediary. A default BlazeServerBuilder accepts inval…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-81356] Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Co…

Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

20/08/2026

[CVE-2026-73256] Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated atta…

Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() function in src/http.c tests hm.proto.len with an impossible greater-than-eight condition even though mg_http_parse() requires an eight-byte protocol stri…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

20/08/2026

[CVE-2026-73257] Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthentica…

Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-73495] blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0…

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names and values, including X-Forwarded-For and internal authorization headers, that a …

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-9190] An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 1…

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP request containing both Content-Length and Transfer-Encoding headers causes a reverse proxy and MarkLo…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-58153] Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked frami…

Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

29/07/2026

[CVE-2026-58155] Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling,…

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

29/07/2026

[CVE-2026-57834] Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affect…

Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

29/07/2026

[CVE-2026-58150] Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade reque…

Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-24033] Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Ap…

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3, from 9.0.0 through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.2 NVD