https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:48:58 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2018-7159 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Withdrawn by the publisher.</strong></p> https://cve.radiocsirt.org/vuln/bell-cve-2018-7159 https://cve.radiocsirt.org/vuln/cleanstart-2026-mm91158 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: nodejs</p> <p>Package nodejs version 8.11.0-r0 fixes 3 vulnerabilities: CVE-2018-7158, CVE-2018-7159, CVE-2018-7160</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: nodejs</p> <p>Package nodejs version 8.11.0-r0 fixes 3 vulnerabilities: CVE-2018-7158, CVE-2018-7159, CVE-2018-7160</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-mm91158 https://cve.radiocsirt.org/vuln/cnvd-2018-18803 cnvd-2018-18803 https://cve.radiocsirt.org/vuln/cnvd-2018-18803 https://cve.radiocsirt.org/vuln/euvd-2026-179281 EUVD-2026-179281 https://cve.radiocsirt.org/vuln/euvd-2026-179281 https://cve.radiocsirt.org/vuln/fkie_cve-2018-7159 <p>The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.</p> <p>The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2018-7159 https://cve.radiocsirt.org/vuln/ghsa-87vg-5pwm-8x6w <p>The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.</p> <p>The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.</p> https://cve.radiocsirt.org/vuln/ghsa-87vg-5pwm-8x6w https://cve.radiocsirt.org/vuln/gsd-2018-7159 gsd-2018-7159 https://cve.radiocsirt.org/vuln/gsd-2018-7159 https://cve.radiocsirt.org/vuln/msrc_cve-2018-7159 msrc_CVE-2018-7159 https://cve.radiocsirt.org/vuln/msrc_cve-2018-7159 https://cve.radiocsirt.org/vuln/rhsa-2018:2949 <p>nodejs: HTTP parser allowed for spaces inside Content-Length header values nodejs: Inspector DNS rebinding vulnerability nodejs: denial of service (DoS) by causing a node server providing an http2 server to crash nodejs: Denial of Service by calling Buffer.fill() or Buffer.alloc() with specially crafted parameters nodejs: Out of bounds (OOB) write via UCS-2 encoding</p> <p>nodejs: HTTP parser allowed for spaces inside Content-Length header values nodejs: Inspector DNS rebinding vulnerability nodejs: denial of service (DoS) by causing a node server providing an http2 server to crash nodejs: Denial of Service by calling Buffer.fill() or Buffer.alloc() with specially crafted parameters nodejs: Out of bounds (OOB) write via UCS-2 encoding</p> https://cve.radiocsirt.org/vuln/rhsa-2018:2949 https://cve.radiocsirt.org/vuln/rhsa-2019:2258 <p>nodejs: HTTP parser allowed for spaces inside Content-Length header values nodejs: Denial of Service with large HTTP headers</p> <p>nodejs: HTTP parser allowed for spaces inside Content-Length header values nodejs: Denial of Service with large HTTP headers</p> https://cve.radiocsirt.org/vuln/rhsa-2019:2258 https://cve.radiocsirt.org/vuln/suse-su-2018:0952-1 <p>Security update for nodejs4</p> <p>Security update for nodejs4</p> https://cve.radiocsirt.org/vuln/suse-su-2018:0952-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-7159 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: nodejs, Ubuntu:Pro:16.04:LTS: nodejs, Ubuntu:Pro:18.04:LTS: nodejs</p> <p>The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: nodejs, Ubuntu:Pro:16.04:LTS: nodejs, Ubuntu:Pro:18.04:LTS: nodejs</p> <p>The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-7159 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0517 <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um dadurch die Integrität, Vertraulichkeit und Verfügbarkeit zu gefährden.</p> <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um dadurch die Integrität, Vertraulichkeit und Verfügbarkeit zu gefährden.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0517