If you learned from my posts, inspired, or encouraged to grow in the cybersecurity and digital forensics, I would really appreciate your vote and support - Husam Shbib!
MyCyberNews

Search

Find merged stories by title or summary.

Vulnerabilities & Patches
Emerging1 src

CVE-2026-54770 - WebOb: Open redirect in Location header normalization via leading C0 control / space characters

CVE ID : CVE-2026-54770 Published : Aug. 20, 2026, 4:31 p. m. • 37 minutes ago Description : WebOb provides objects for HTTP requests and responses. Prior to 1. 8. 11, Response. _make_location_absolute() in src/webob/response. py checks a Location value for a URI scheme or leading double slash before urllib. parse. urljoin() strips leading C0 control characters and spaces. An attacker-controlled value such as a space followed by a protocol-relative or absolute URL can therefore bypass SCHEME_RE and startswith("//") checks and be normalized to an off-host redirect. Request. relative_url() and webob. exc. _HTTPMove subclasses, including HTTPFound, are also affected because they use the same unsafe URL joining behavior or bypass the earlier normalization path.

·CVEFeed
Read →

You've reached the end of current stories for this search.