Reverse-Proxy — PoC Archivehttps://poc.intelseclab.com/tags/reverse-proxy/Latest proof-of-concept entries.Hugoen-usSat, 11 Jul 2026 00:00:00 +0000Gitea Docker Image Reverse-Proxy Authentication Bypass — "One Header, Any User" (CVE-2026-20896)https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2026-20896-gitea-docker-reverse-proxy-auth-bypass/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2026-20896-gitea-docker-reverse-proxy-auth-bypass/Critical severity (CVSS 9.8) — web · CVE-2026-20896 (GHSA-f75j-4cw6-rmx4). Status: Weaponized (public PoC + detector script, actively exploited in the wild per Sysdig). Affects: Gitea — official Docker images (gitea/gitea), both root and rootless variants. Tags: gitea, docker, authentication-bypass, reverse-proxy, header-spoofing, unauthenticated, remote, cwe-290, actively-exploited.webCriticalgiteadockerauthentication-bypassreverse-proxyheader-spoofingunauthenticatedremotecwe-290actively-exploitedNGINX HTTP/2 Frame Injection via Vulnerable Upstream Proxying (CVE-2026-42926)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-42926-nginx-http2-frame-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-42926-nginx-http2-frame-injection/High severity — web · CVE-2026-42926. Status: PoC. Affects: NGINX (HTTP/2 upstream proxying). Tags: nginx, http2, frame-injection, reverse-proxy, request-smuggling, docker-lab.webHighnginxhttp2frame-injectionreverse-proxyrequest-smugglingdocker-labHAProxy HTTP/3 (QUIC) Standalone FIN Body Validation Bypass Leading to Request Smuggling — CVE-2026-33555https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-33555-haproxy-h3-request-smuggling/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-33555-haproxy-h3-request-smuggling/High severity — network · CVE-2026-33555. Status: PoC. Affects: HAProxy with HTTP/3 (QUIC) support built (USE_QUIC=1); tested on HAProxy 3.0.18. Tags: haproxy, http3, quic, request-smuggling, http-reuse, content-length, reverse-proxy, cross-user.networkHighhaproxyhttp3quicrequest-smugglinghttp-reusecontent-lengthreverse-proxycross-userApache APISIX forward-auth CRLF Header Injection — CVE-2026-31908https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-31908-apisix-crlf-header-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-31908-apisix-crlf-header-injection/Critical severity (CVSS 10) — web · CVE-2026-31908. Status: PoC. Affects: Apache APISIX. Tags: apisix, crlf-injection, header-injection, authentication-bypass, forward-auth, api-gateway, reverse-proxy.webCriticalapisixcrlf-injectionheader-injectionauthentication-bypassforward-authapi-gatewayreverse-proxynghttpx HTTP/1.1 Upgrade Request Body Response Queue Poisoninghttps://poc.intelseclab.com/pocs/network/2026-07-03_nghttpx-http-upgrade-queue-poisoning/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_nghttpx-http-upgrade-queue-poisoning/High severity — network · None assigned as of 2026-07-03. Status: PoC. Affects: nghttp2's nghttpx reverse proxy. Tags: nghttp2, nghttpx, reverse-proxy, request-smuggling, response-queue-poisoning, http-desync, upgrade-request, cache-poisoning.networkHighnghttp2nghttpxreverse-proxyrequest-smugglingresponse-queue-poisoninghttp-desyncupgrade-requestcache-poisoning