Threats Tagged 'cve-2026-54278'
View all threats tagged with 'cve-2026-54278'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-54278'
Click on any threat for detailed analysis and mitigation recommendations
### Summary Attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. ### Impact In the unlikely situation that an application is passing user-controlled strings into `MultipartWriter.append(headers=...)` or `Payload.headers`, then an attacker may be able to modify the request to inject headers or change the contents of the request. ### Workaround Sanitise such user input. ----- Patch: https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8 Join the discussion | GCVE Database | 08/13/2026, 17:46:47 UTC Added: 09/17/2026, 01:59:06 UTC |
0 ### Summary During cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. ### Impact An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). ### Workaround Disable compression if unable to upgrade. ----- Patch: https://github.com/aio-libs/aiohttp/commit/4f7480e474cccc6a8cc2c92ad3f17a31dedf8232 Join the discussion | CVE Database V5 | 08/13/2026, 17:46:47 UTC Added: 06/22/2026, 17:39:40 UTC |
Showing 1 to 2 of 2 results