Live › vulnerability › CVE-2026-93003
Go to dashboardThe Web add-on's HTTP server scans the whole request packet for header fields rather than stopping at the end of the header section. A header name placed in the body is treated as a real header, so a client can influence request framing it should not control.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing decisions it should not be able to reach.
This page as .md · .json · in your agent: get_signal("CVE-2026-93003")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.