MEDIUM 6.9 NVD

CVE-2026-93003

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name plac

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing decisions it should not be able to reach.

References

https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-qjvr-68c3-5qhg

Published: 2026-10-20 · Source: NVD · Feed updated: 2026-10-20

This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-10-20 via NVD.

vulnfeed aggregates 16920 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.