CVE detail
CVE-2025-26803
The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 17.9 · diversity 15.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
5 source links · newest first
- https://www.phusionpassenger.com/supportwww.phusionpassenger.com
No excerpt available.
Productwww.phusionpassenger.comFeb 24, 2025, 4:15 PM No excerpt available.
Exploitgithub.comFeb 24, 2025, 4:15 PMNo excerpt available.
Exploitgithub.comFeb 24, 2025, 4:15 PMNo excerpt available.
Exploitgithub.comFeb 24, 2025, 4:15 PM- https://blog.phusion.nl/2025/02/19/passenger-6-0-26/blog.phusion.nl
No excerpt available.
Vendor Advisoryblog.phusion.nlFeb 24, 2025, 4:15 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-66038CVSS 7.1 · High
FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap me…
- CVE-2026-66034CVSS 7.7 · High
libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds…
- CVE-2026-47247CVSS 7.5 · High
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid…
- CVE-2026-16386CVSS 7.5 · High
Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
- CVE-2026-16385CVSS 7.5 · High
Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
- CVE-2026-16384CVSS 7.5 · High
Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.