CVE-2026-93003

MediumCVSS 6.9

Published: 20/10/2026(UTC)Updated: 20/10/2026(UTC)Translated: 20/10/2026(UTC)NVD NIST

Summary

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is reported to the server as though it were a header, letting a client control request framing decisions it should not reach.

Risk Assessment

A client can influence request framing interpretation (e.g., request smuggling), potentially bypassing security controls or poisoning caches.

Recommendation

Update the Web add-on to a version containing the fix that limits header search to the header section.

Other vulnerabilities in Web add-on

CVE-2026-94018High
The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a Content-Length underflow while processing a PUT request. The condition is reachable by an unauthenticated remote client with a single malformed request.

Original NVD description (English source)

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing decisions it should not be able to reach.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS