9.8
Critique
CVE-2026-22903 An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie
Description
An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buffer overflow in the modified lighttpd server, causing it to crash and potentially enabling remote code execution due to missing stack protections.
Produits et versions touchés
Autres CVE de 0852-1322
Les 4 CVE de 0852-1322 →
CVE-2026-22906
User credentials are stored using AES‑ECB encryption with a hardcoded key
9.8
Critique
CVE-2026-22905
An unauthenticated remote attacker can bypass authentication by exploiting insufficient URI validation and using path…
7.5
Élevée
CVE-2026-22904
Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote…
9.8
Critique