pyn3rd

Security researcher with over 10 years of experience in application&cloud security. Speaker at BlackHat, HITB, CanSecWest and TyphoonCon.

[pyn3rd @pyn3rd]

I know that for sure. However, even when a Content-Length header is present, inconsistencies in the Content-Type header can still create problems. Some WAFs, such as F5 BIG-IP, may treat such requests as protocol non-compliant and refuse to forward them to the upstream application.

The concern is that with this type of “chaotic” request, forwarding it can introduce security risks regardless of whether the WAF chooses the first or the second interpretation.

For example, if the WAF parses and validates the request as application/x-www-form-urlencoded while the upstream application interprets it as application/json, discrepancies in request processing may arise, potentially leading to security issues. The reverse scenario is equally problematic.

[BRute Logic @BRuteLogic]

@pyn3rd That's correct but it's missing the content length because the focus of the post was the duplicate headers. It's not meant to be used verbatim.

[pyn3rd @pyn3rd]

Regarding the ApacheMQ vulnerabilities we reported, one was dismissed as not a security issue because its root cause lies in Xstream, which now whitelists only java.lang.String for deserialization.

This post strongly warns you about configuring systems in untrusted environments.

[VulnTracker @vuln_tracker]

Apache ActiveMQ is having a rough month. Two more CVEs.

⚠️ CVE-2026-42253 - HTTP Response Header Injection via JMS Message Properties
⚠️ CVE-2026-42588 - RCE via Jolokia addNetworkConnector

The Jolokia one is the scary one - default access policy permits exec operations on all ActiveMQ MBeans.

Fix: upgrade to 5.19.7 or 6.2.6.

https://t.co/ZKW1C9Wye2

[pyn3rd @pyn3rd]

#CVE-2026-42253 Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties

#CVE-2026-42588 Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector

These two vulnerabilities we reported have been credited.

[pyn3rd @pyn3rd]

This kind of abnormal HTTP request is related to protocol compliance with the RFC specifications. For example, Akamai WAF even rejects POST requests that do not include a Content-Length header.

[BRute Logic @BRuteLogic]

POST /api/update HTTP/1.1
Host: https://t.co/poBhv0Qu9i
Content-Type: application/x-www-form-urlencoded
Content-Type: application/json

{"test": true}

[pyn3rd @pyn3rd]

@Chirag99Artani @TheLaluka There’s no CVE for it. I found it pretty casually.:-D

[pyn3rd @pyn3rd]

Trivial to locate an exposed MBean in Apache Karaf’s Jolokia endpoint that allows loading a malicious remote JAR, resulting in RCE.@TheLaluka

[pyn3rd @pyn3rd]

@whithat444 @AlibabaGroup @alibaba_cloud what’s the problem?

[pyn3rd @pyn3rd]

If you have any Log4Shell obfuscated variants for WAF bypass, please let me know — my detection approach can normalize and reconstruct all of them😆
https://t.co/9E1lgA9tuA

[Secuaudit @Secuaudit]

Hey bug bounty hunters 👋Apache log4j is not dead. Before you skip Apache log4j targets in 2026 — read this : https://t.co/tJ5lHaoFcv
We documented exactly where, how, and how to report it clean.Drop everything and read:

#BugBounty #Log4Shell #BugBountyTips

[pyn3rd @pyn3rd]

@steventseeley You make my day!

[pyn3rd @pyn3rd]

@matthias_kaiser Thank you as always.

[pyn3rd @pyn3rd]

Amazing vibe! Really impressive experience !

[TyphoonCon🌪️ @typhooncon]

🌪️ Now on stage @pyn3rd revealing the hidden attack surface ClickHouse

[pyn3rd @pyn3rd]

@subhashdasyam @typhooncon I think so.

[pyn3rd @pyn3rd]

@m01e_exp Sure! I will publish it very soon:-)

[pyn3rd @pyn3rd]

@m01e_exp To be honest, ClickHouse-related components.

[pyn3rd @pyn3rd]

@mdisec Hope to collaborate with you next year!

[TyphoonCon🌪️ @typhooncon]

🌪️ Now on stage @pyn3rd revealing the hidden attack surface ClickHouse

[pyn3rd @pyn3rd]

@D0rkerDevil @typhooncon Sadly, see you next time!

[pyn3rd @pyn3rd]

Just arrived in Seoul for @typhooncon!
Not only is this my first time attending the conference, but it’s also my first time in Korea. Really loving the vibe already! 🇰🇷

[pyn3rd @pyn3rd]

@matthias_kaiser @typhooncon Thank you so much for the inspiration.

[pyn3rd @pyn3rd]

@thegrugq @steventseeley You made my day.