CVE-2025-26803

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-908

Affected software

No affected versions have been published.

Timeline

Published: Feb 24, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-26819.8A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. Affected by this issue is some unk CVE-2025-268166.5A vulnerability in Intrexx Portal Server 12.0.2 and earlier which was classified as problematic potentially allows users with particular per CVE-2025-268179.8Netwrix Password Secure 9.2.0.32454 allows OS command injection.CVE-2025-268189.8Netwrix Password Secure through 9.2 allows command injection.CVE-2025-268197.5Monero through 0.18.3.4 before ec74ff4 does not have response limits on HTTP server connections.CVE-2025-26829.8A vulnerability classified as critical has been found in PHPGurukul Bank Locker Management System 1.0. This affects an unknown part of the f CVE-2025-26839.8A vulnerability classified as critical was found in PHPGurukul Bank Locker Management System 1.0. This vulnerability affects unknown code of CVE-2025-26849.8A vulnerability, which was classified as critical, has been found in PHPGurukul Bank Locker Management System 1.0. This issue affects some u CVE-2025-268416.1Cross Site Scripting vulnerability in WPEVEREST Everest Forms before 3.0.9 allows an attacker to execute arbitrary code via a file upload.CVE-2025-268427.5An issue was discovered in Znuny through 7.1.3. If access to a ticket is not given, the content of S/MIME encrypted e-mail messages is visib CVE-2025-268449.8An issue was discovered in Znuny through 7.1.3. A cookie is set without the HttpOnly flag.CVE-2025-268459.8An Eval Injection issue was discovered in Znuny through 7.1.3. A user with write access to the configuration file can use this to execute a