RHSA-2026:25090: Important: httpd:2.4 security update

CVE-2025-60876 BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).

CVE-2026-6324 Libsoup: libsoup: http request smuggling via unsigned to signed conversion error

CVE-2025-23167 A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination. Impact: * This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.

USN-8343-1: multipart vulnerability

USN-8338-1: Apache HTTP Server vulnerabilities

CVE-2026-9256 NGINX ngx_http_rewrite_module vulnerability

CVE-2026-44431 urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

RHSA-2026:15968: Moderate: libsoup3 security update

CVE-2026-2708 Libsoup: libsoup: http request smuggling via duplicate content-length headers

CVE-2026-39882 OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies

CVE-2026-1965 bad reuse of HTTP Negotiate connection

CVE-2026-3644 Incomplete control character validation in http.cookies

CVE-2025-62718 Axios has a NO_PROXY Hostname Normalization Bypass Leads to SSRF

CVE-2026-40175 Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

HAProxy HTTP/3 -> HTTP/1 Desync: Cross-Protocol Smuggling via a Standalone QUIC FIN (CVE-2026-33555)

Cisco Identity Services Engine Remote Code Execution Vulnerabilities

Cisco Secure Web Appliance Authentication Bypass Vulnerability

Fixing request smuggling vulnerabilities in Pingora OSS deployments

The Forgotten Bug: How a Node.js Core Design Flaw Enables HTTP Request Splitting

Http11Probe - Probe for Http 1.1 compliance