CVE-2026-1502None▾ Sunlit

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0.1 · exploitation 0

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Apr 10, 2026

Updated

Jun 30, 2026

CVSS

—

Vendor

—

Product

—

CWE

CWE-93

Depth score

3 · Minimal

EPSS

0.56% · p47

Platforms

—

Source

NVD

Vector

—

Exploit-prediction probability, daily snapshots since Jul 31.

0.6% → 0.6%

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 112 days

Full technical detail▾

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Connected by shared product, vendor, weakness, or advisory.

#nvd