https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T13:46:42.292617+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2015-7519 CVE-2015-7519 2026-10-04T13:46:42.323657+00:00

agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.

 https://cve.radiocsirt.org/vuln/ghsa-fxwv-953p-7qpf GHSA-fxwv-953p-7qpf — Phusion Passenger allows remote attackers to spoof headers 2026-10-04T13:46:42.323712+00:00

Affected: RubyGems: passenger

`agent/Core/Controller/SendRequest.cpp` in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an `_` (underscore) character instead of a `-` (dash) character in an HTTP header, as demonstrated by an `X_User` header.