2 Commits

Author SHA1 Message Date
nicolargo
0de3b8f875 XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard - CVE-2026-46608 2026-05-23 11:40:20 +02:00
nicolargo
b88dd7bcfd test(xmlrpc): failing test — spoofed Host should be rejected (CVE-2026-46611)
Adds a second test server bound to a config that enables xmlrpc_allowed_hosts,
plus the failing assertion that a spoofed Host header returns 400. The fix in
glances/server.py follows in the next commit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-23 09:50:40 +02:00