Konrad Pietrzak / Ericsson

httpd parks a request worker indefinitely on a malformed chunk size sent after the headers

inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception

inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length

inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i

httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems

httpc does not bound server-supplied numeric header values before integer conversion

httpd applies no timeout while receiving a request body, parking a worker on a stalled client

eldap does not bound the port component of a referral URL before integer conversion

snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields

httpd does not enforce the documented default max_clients connection limit