https://vulnerability.circl.lu/sightings/feed 2026-08-07T07:12:40.636428+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/90a504a9-cb1d-4c28-9466-ea634251b139/export 2026-08-07T07:12:40.653040+00:00 Joseph Lee https://cvepremium.circl.lu/user/syspect {"uuid": "90a504a9-cb1d-4c28-9466-ea634251b139", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71326", "type": "published-proof-of-concept", "source": "https://github.com/traefik/traefik/security/advisories/GHSA-6765-c87h-8mrf", "content": "", "creation_timestamp": "2026-08-06T18:35:20.349821Z"} 2026-08-06T18:35:20.349821+00:00 https://vulnerability.circl.lu/sighting/5260170f-5697-4824-bb4e-4ac9a6b729e3/export 2026-08-07T07:12:40.654731+00:00 Joseph Lee https://cvepremium.circl.lu/user/syspect {"uuid": "5260170f-5697-4824-bb4e-4ac9a6b729e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71327", "type": "published-proof-of-concept", "source": "https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx", "content": "", "creation_timestamp": "2026-08-06T18:35:18.053743Z"} 2026-08-06T18:35:18.053743+00:00 https://vulnerability.circl.lu/sighting/30c48af0-1ea8-4734-b4b7-2b7a5f40fa29/export 2026-08-07T07:12:40.654831+00:00 Joseph Lee https://cvepremium.circl.lu/user/syspect {"uuid": "30c48af0-1ea8-4734-b4b7-2b7a5f40fa29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71325", "type": "published-proof-of-concept", "source": "https://github.com/traefik/traefik/security/advisories/GHSA-62fc-8686-hfmq", "content": "", "creation_timestamp": "2026-08-06T18:35:13.503744Z"} 2026-08-06T18:35:13.503744+00:00 https://vulnerability.circl.lu/sighting/cd28d23a-7db0-4024-a5b0-ccec0959d8b7/export 2026-08-07T07:12:40.654910+00:00 Joseph Lee https://cvepremium.circl.lu/user/syspect {"uuid": "cd28d23a-7db0-4024-a5b0-ccec0959d8b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71324", "type": "published-proof-of-concept", "source": "https://github.com/traefik/traefik/security/advisories/GHSA-3ccp-42pg-hgv6", "content": "", "creation_timestamp": "2026-08-06T16:35:02.616191Z"} 2026-08-06T16:35:02.616191+00:00 https://vulnerability.circl.lu/sighting/aca6d5fc-0bcd-4926-ba10-1f13da947655/export 2026-08-07T07:12:40.654981+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "aca6d5fc-0bcd-4926-ba10-1f13da947655", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71324", "type": "seen", "source": "https://gist.github.com/alon710/44f5ca1944b401eb63cfb2fdd265ca45", "content": "# CVE-2026-71324: CVE-2026-71324: Cross-User Response Poisoning in Traefik via HTTP/2 and HTTP/3 CONNECT Handling\n\n> **CVSS Score:** 7.0\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71324\n\n## Summary\nCVE-2026-71324 is a high-severity HTTP request smuggling vulnerability in the Traefik reverse proxy. It allows an unauthenticated remote attacker to achieve cross-user response poisoning when Traefik is configured to route HTTP/2 or HTTP/3 CONNECT requests to an HTTP/1.1 upstream backend. By sending a crafted CONNECT request that is subsequently rejected by the backend with a keep-alive non-2xx response, the attacker can leave smuggled requests within the shared connection pool, which are then served to subsequent clients.\n\n## TL;DR\nAn unauthenticated remote attacker can poison the backend connection pool in Traefik by sending HTTP/2 or HTTP/3 CONNECT requests containing smuggled payloads. When the upstream HTTP/1.1 server rejects the tunnel, unconsumed payload bytes remain in the connection buffer and are served to other users.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-444\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 7.0 (High)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n- **Impact**: Cross-User Response Poisoning\n\n## Affected Systems\n\n- Traefik Proxy (versions < 2.11.53)\n- Traefik Proxy (versions 3.0.0 to 3.6.23)\n- Traefik Proxy (versions 3.7.0 to 3.7.8)\n- **Traefik**: < 2.11.53 (Fixed in: `2.11.53`)\n- **Traefik**: >= 3.0.0, < 3.6.24 (Fixed in: `3.6.24`)\n- **Traefik**: >= 3.7.0, < 3.7.9 (Fixed in: `3.7.9`)\n\n## Mitigation\n\n- Upgrade Traefik to a patched version (2.11.53, 3.6.24, or 3.7.9).\n- Disable HTTP/2 and HTTP/3 on Traefik entrypoints to prevent Extended CONNECT negotiations.\n- Disable 'forwardBody' and 'preserveRequestMethod' in the ForwardAuth middleware configuration.\n- Configure WAF rules to block external client requests that employ the CONNECT method.\n\n**Remediation Steps:**\n1. Identify the current running version of Traefik in your environment.\n2. Download the matching patched release (e.g., v3.7.9 if currently on v3.7.x) from the official repository.\n3. Update deployment manifests or container image references to point to the new version.\n4. Perform a rolling restart of the Traefik proxy instances to apply the changes.\n5. Validate that HTTP/2 and HTTP/3 services function correctly and monitor connection metrics.\n\n## References\n\n- [GHSA-3ccp-42pg-hgv6: Response poisoning via CONNECT requests](https://github.com/traefik/traefik/security/advisories/GHSA-3ccp-42pg-hgv6)\n- [CVE.org Authority Record for CVE-2026-71324](https://www.cve.org/CVERecord?id=CVE-2026-71324)\n- [Traefik v3.7.9 Release Notes](https://github.com/traefik/traefik/releases/tag/v3.7.9)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71324) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T16:31:29.260656Z"} 2026-08-06T16:31:29.260656+00:00 https://vulnerability.circl.lu/sighting/d5b67698-154c-4217-9dcb-bd9866c31a1c/export 2026-08-07T07:12:40.655773+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "d5b67698-154c-4217-9dcb-bd9866c31a1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71320", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117049175839813983", "content": "CVE-2026-71320 - Critical RCE in Nuxt via template injection in /__nuxt_island/ props when runtimeCompiler enabled. CVSS 8.1. Update to 3.21.10/4.5.1 now. #CVE #Nuxt #infosec\nhttps://www.valtersit.com/cve/CVE-2026-71320/", "creation_timestamp": "2026-08-06T15:05:40.037549Z"} 2026-08-06T15:05:40.037549+00:00 https://vulnerability.circl.lu/sighting/5146ce46-7c42-4a10-bf1e-7d6958d1d37b/export 2026-08-07T07:12:40.655857+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "5146ce46-7c42-4a10-bf1e-7d6958d1d37b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71320", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3msgcunpywu2k", "content": "CVE-2026-71320 - Critical RCE in Nuxt via template injection in /__nuxt_island/ props when runtimeCompiler enabled. CVSS 8.1. Update to 3.21.10/4.5.1 now. #CVE #Nuxt #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-71320/", "creation_timestamp": "2026-08-06T15:04:44.261950Z"} 2026-08-06T15:04:44.261950+00:00 https://vulnerability.circl.lu/sighting/6ab6c450-75c9-4755-a47e-19de25015f57/export 2026-08-07T07:12:40.655935+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "6ab6c450-75c9-4755-a47e-19de25015f57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71320", "type": "seen", "source": "https://gist.github.com/alon710/71f7a1bcf3053bbd51b0ae56e484d06e", "content": "# CVE-2026-71320: CVE-2026-71320: Remote Code Execution in Nuxt via Server-Side Template Injection in Server Islands\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71320\n\n## Summary\nA highly critical Server-Side Remote Code Execution (RCE) vulnerability exists in the Nuxt framework when Server Islands and the Vue runtime compiler are simultaneously enabled. This allows unauthenticated remote attackers to execute arbitrary system commands on the host process by passing a crafted component definition object to the dynamic component resolution engine via public island endpoints.\n\n## TL;DR\nUnauthenticated Remote Code Execution (RCE) in Nuxt via Server-Side Template Injection (SSTI) when the Vue runtime compiler is enabled, triggered through crafted props sent to Server Island endpoints.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94: Improper Control of Generation of Code ('Code Injection')\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 8.1 (High)\n- **EPSS Score**: Not Registered / New CVE\n- **Impact**: Server-Side Remote Code Execution (RCE)\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Nuxt 3.x applications with server islands and runtime compiler active\n- Nuxt 4.x applications with server islands and runtime compiler active\n- **Nuxt**: >= 3.4.0, < 3.21.10 (Fixed in: `3.21.10`)\n- **Nuxt**: >= 4.0.0, < 4.5.1 (Fixed in: `4.5.1`)\n\n## Mitigation\n\n- Upgrade to Nuxt 3.21.10 or 4.5.1 to leverage built-in island prop filtering.\n- Set vue.runtimeCompiler to false in nuxt.config.ts to block server-side compiling.\n- Configure WAF rules to reject HTTP requests containing a nested template key targeted at /__nuxt_island/.\n\n**Remediation Steps:**\n1. Analyze nuxt.config.ts for the presence of vue.runtimeCompiler: true.\n2. If the runtime compiler is not required, disable or remove the line.\n3. Run npm update nuxt or yarn upgrade nuxt to fetch versions >= 3.21.10 or >= 4.5.1.\n4. Deploy the updated application and verify that island requests containing a template prop return HTTP 400.\n\n## References\n\n- [GHSA-9473-5f9j-94wq: SSTI / RCE in Server Islands via Vue Runtime Compiler](https://github.com/nuxt/nuxt/security/advisories/GHSA-9473-5f9j-94wq)\n- [CVE-2026-71320 NVD Record](https://www.cve.org/CVERecord?id=CVE-2026-71320)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71320) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T01:31:21.671680Z"} 2026-08-06T01:31:21.671680+00:00 https://vulnerability.circl.lu/sighting/7ca4683d-b27a-42b5-a2c1-dd6dffbdd3a0/export 2026-08-07T07:12:40.656028+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "7ca4683d-b27a-42b5-a2c1-dd6dffbdd3a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71321", "type": "seen", "source": "https://gist.github.com/alon710/9e89754682c03d2a6b1ce15876ecc693", "content": "# CVE-2026-71321: CVE-2026-71321: Unauthenticated Denial of Service and CPU Exhaustion in Nuxt Island Renderer\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71321\n\n## Summary\nAn unauthenticated remote denial of service vulnerability exists in the Nuxt framework island renderer endpoint. By transmitting large or deeply nested JSON payloads, an attacker can block the single-threaded Node.js event loop, resulting in application-wide CPU exhaustion before signature verification occurs.\n\n## TL;DR\nUnauthenticated POST requests with massive or deeply nested JSON to Nuxt's internal island endpoint block the single-threaded Node.js event loop, causing a complete denial of service before verifying cryptographic signatures.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-407 / CWE-770\n- **Attack Vector**: Network\n- **CVSS v3.1**: 7.5 (High)\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n- **Impact**: Denial of Service (CPU Exhaustion)\n\n## Affected Systems\n\n- Nuxt Framework versions 3.x prior to 3.21.10\n- Nuxt Framework versions 4.x prior to 4.5.1\n- **nuxt**: >= 3.1.0, < 3.21.10 (Fixed in: `3.21.10`)\n- **nuxt**: >= 4.0.0, < 4.5.1 (Fixed in: `4.5.1`)\n\n## Mitigation\n\n- Upgrade Nuxt to version 3.21.10, 4.5.1, or higher.\n- Implement request body size limits at the reverse proxy or WAF layer specifically for the island endpoint path.\n- Deploy rate limiting on Nuxt island rendering paths to mitigate rapid-fire POST attacks.\n\n**Remediation Steps:**\n1. Identify any deployed applications running vulnerable versions of Nuxt (3.1.0 to 3.21.9, or 4.0.0 to 4.5.0).\n2. Update the dependency configuration in package.json to reference a secure version (e.g., ^3.21.10 or ^4.5.1).\n3. Run the corresponding package manager install command (e.g., npm install, yarn install, or pnpm install) to apply the update.\n4. Validate the deployed environment behavior by verifying that payloads over 64KB on the island endpoint return an HTTP 413 error status code.\n\n## References\n\n- [Nuxt Security Advisory (Primary source)](https://github.com/nuxt/nuxt/security/advisories/GHSA-9pgf-384g-p7mv)\n- [Core Fix Commit (Nitro Island Handler)](https://github.com/nuxt/nuxt/commit/4e35ae9babd94be53246e31200232d48438bb34e)\n- [Secondary Fix Commit (Nitro Island Handler)](https://github.com/nuxt/nuxt/commit/668cdfdfda41849ed11c1ee5e2067a11fc103b22)\n- [Nuxt v3.x Patched Release Notes](https://github.com/nuxt/nuxt/releases/tag/v3.21.10)\n- [Nuxt v4.x Patched Release Notes](https://github.com/nuxt/nuxt/releases/tag/v4.5.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71321) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T00:31:22.953671Z"} 2026-08-06T00:31:22.953671+00:00 https://vulnerability.circl.lu/sighting/261cf48e-db64-4430-8d87-0c6687cb42ad/export 2026-08-07T07:12:40.656117+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "261cf48e-db64-4430-8d87-0c6687cb42ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71321", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mserrc4jjo2x", "content": "Nuxt Bleeds Out Again While Bureaucrats Admire the Alarm Light\nPANIC 72% | Lag 0.0h | CVE-2026-71321 is a high-severity vulnerability affecting Nuxt versions from 3.1.0 through 3.21.10 a\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-08-06T00:25:58.579318Z"} 2026-08-06T00:25:58.579318+00:00