https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 22:42:22 +0000 https://cve.radiocsirt.org/vuln/cve-2026-44974 <p><strong>Affected:</strong> hapijs content</p> <p>@hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retained the last occurrence of each duplicate parameter while Content.type() retained the first occurrence of duplicate charset and boundary parameters, creating a parameter-smuggling primitive when another component in the request-processing chain resolves duplicates the opposite way. This can allow an upload filename allowlist bypass in headers such as Content-Disposition: form-data; name=&#34;file&#34;; filename=&#34;safe.txt&#34;; filename=&#34;shell.php&#34;. This issue is fixed in version 6.0.2.</p> <p><strong>Affected:</strong> hapijs content</p> <p>@hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retained the last occurrence of each duplicate parameter while Content.type() retained the first occurrence of duplicate charset and boundary parameters, creating a parameter-smuggling primitive when another component in the request-processing chain resolves duplicates the opposite way. This can allow an upload filename allowlist bypass in headers such as Content-Disposition: form-data; name=&#34;file&#34;; filename=&#34;safe.txt&#34;; filename=&#34;shell.php&#34;. This issue is fixed in version 6.0.2.</p> https://cve.radiocsirt.org/vuln/cve-2026-44974