HackerOne Disclosed Reports - 2026-10-16

Medium
resolved

Unauthenticated go-httpbin servers : Leads to Cookie Tossing on *.aws.dev and Open Redirect

Bug reported by notnotnotveg was disclosed at October 16, 2026, 9:35 pm   |   Missing Authentication for Critical Function

Multiple security vulnerabilities were identified in an unauthenticated go-httpbin server instance. An endpoint was found to accept arbitrary cookie domain parameters, allowing attacker-controlled cookies to be set across subdomains of a parent domain. This caused cookies to be delivered to unrelated sibling applications. A crafted cookie value was observed to trigger a denial of service response when received by another application on the same domain. Additionally, an open redirect endpoint was discovered that accepted arbitrary URLs and redirected users without validation. The cookie injection issue was verified to have practical cross-tenant impact through denial of service conditions.

Medium
resolved

Memory exhaustion (DoS) via unbounded file read in `EncodingDiscovery.detect_encoding()`

Bug reported by 0xsumit was disclosed at October 16, 2026, 10:08 am   |   Uncontrolled Resource Consumption

A memory exhaustion vulnerability was discovered in the encoding detection function that loaded entire files into memory without size restrictions. The vulnerability affected the translation discovery process, where a single large translation file could cause peak memory usage to reach approximately three times the file size. This issue was present across multiple code paths and could be triggered automatically during version control system updates, potentially resulting in out-of-memory conditions on resource-constrained systems. The vulnerability was addressed by implementing bounded file reading with a size limit consistent with other sniffing operations in the codebase.