Konrad Pietrzak

httpc leaks Authorization header to cross-origin redirect targets

ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)

inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth

Request smuggling via first-wins Content-Length parsing in inets httpd