request smuggling

CVE-2026-2708 is a reminder that some of the most consequential web vulnerabilities still begin with a deceptively small parsing decision: what should a server do when an HTTP request contains more than one Content-Length header? The flaw, assigned to libsoup, concerns HTTP/1 request smuggling...

Microsoft’s security page has recorded a new HTTP request‑smuggling vulnerability, tracked as CVE‑2026‑23941, which stems from how the Erlang/OTP inets HTTP server (httpd) parses conflicting Content‑Length headers using a “first‑wins” strategy — a parsing mismatch that lets an attacker...