https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T22:20:58.548539+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2021-25702 cnvd-2021-25702 2026-10-12T22:20:58.551630+00:00 cnvd-2021-25702 https://cve.radiocsirt.org/vuln/euvd-2026-38090 EUVD-2026-38090 2026-10-12T22:20:58.551660+00:00 EUVD-2026-38090 https://cve.radiocsirt.org/vuln/fkie_cve-2020-7670 fkie_cve-2020-7670 2026-10-12T22:20:58.551675+00:00

agoo prior to 2.14.0 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks where `agoo` is used as part of a chain of backend servers due to insufficient `Content-Length` and `Transfer Encoding` parsing.

 https://cve.radiocsirt.org/vuln/ghsa-h385-52j6-9984 Withdrawn: GHSA-h385-52j6-9984 — Withdrawn: HTTP Request Smuggling in Agoo 2026-10-12T22:20:58.551705+00:00

Withdrawn by the publisher.

Affected: RubyGems: agoo

# Withdrawn reason Withdrawn on 1/13/2021 due to [this comment from the maintainer](https://github.com/ohler55/agoo/issues/88#issuecomment-723580783). This is no longer considered a vulnerability.

# Original description agoo through 2.12.3 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks.

 https://cve.radiocsirt.org/vuln/gsd-2020-7670 gsd-2020-7670 2026-10-12T22:20:58.551732+00:00 gsd-2020-7670