Lukas Backström / Erlang Solutions

inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth

inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception

inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length

inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i

httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems

httpd applies no timeout while receiving a request body, parking a worker on a stalled client

httpd does not enforce the documented default max_clients connection limit

httpd parks a request worker indefinitely on a malformed chunk size sent after the headers

inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation