Kuranikaran

**Name of the Vulnerable Software and Affected Versions** swift-nio-http2 versions prior to 1.44.0 **Description** The HTTP/2-to-HTTP/1.1 codec, specifically `HTTP2FramePayloadToHTTP1ServerCodec` and `HTTP2ToHTTP1ServerCodec`, fails to validate pseudo-header values for control characters before translating them into HTTP/1.1 messages. A remote attacker can send HTTP/2 requests containing Carriage Return (CR), Line Feed (LF), or Null (NUL) bytes in pseudo-headers such as `:path`. Because HTTP/2 uses binary framing, these characters are not parsed as line terminators at the HTTP/2 layer and are passed to the HTTP/1.1 output. This can lead to request smuggling, where the resulting output contains injected headers or entirely smuggled requests, particularly in reverse-proxy configurations. This issue affects any server translating HTTP/2 requests to HTTP/1.1, including server-side Swift frameworks like Vapor. **Recommendations** Update to version 1.44.0 or later.

**Name of the Vulnerable Software and Affected Versions** Uptime Kuma versions 2.0.0 through 2.1.3 **Description** Uptime Kuma is an open source, self-hosted monitoring tool. The `GET /api/badge/:id/ping/:duration?` endpoint in `server/routers/api-router.js` does not verify that the requested monitor belongs to a public group. All other badge endpoints check for public access before returning data, but the ping endpoint skips this check. This allows unauthenticated users to extract average ping/response time data for private monitors. The issue is related to a missing check for public access before calling `UptimeCalculator.getUptimeCalculator(requestedMonitorId)`. The vulnerable endpoint is ''/api/badge/:id/ping/:duration?'', and the vulnerable variable is `requestedMonitorId`. An unauthenticated attacker can enumerate private monitor IDs and extract average response time data for private monitors, potentially inferring the existence and reachability of internal monitored services. **Recommendations** Versions prior to 2.2.0 are affected. Update to version 2.2.0 or later to resolve this issue.