CVE-2020-11724

An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API.

• CWE-444

• https://github.com/openresty/lua-nginx-module/commit/9ab38e8ee35fc08a57636b1b6190dca70b0076faPatch, Third Party Advisory
• https://github.com/openresty/openresty/blob/4e8b4c395f842a078e429c80dd063b2323999957/patches/ngx_http_lua-0.10.15-fix_location_capture_content_length_chunked.patchPatch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/07/msg00014.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210129-0002/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4750Third Party Advisory
• https://github.com/openresty/lua-nginx-module/commit/9ab38e8ee35fc08a57636b1b6190dca70b0076faPatch, Third Party Advisory
• https://github.com/openresty/openresty/blob/4e8b4c395f842a078e429c80dd063b2323999957/patches/ngx_http_lua-0.10.15-fix_location_capture_content_length_chunked.patchPatch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/07/msg00014.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210129-0002/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4750Third Party Advisory

Published

Apr 12, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11719An issue was discovered in Programi Bilanc build 007 release…7.5
• CVE-2020-1172<p>A remote code execution vulnerability exists in the way t…4.2
• CVE-2020-11720An issue was discovered in Programi Bilanc build 007 release…9.8
• CVE-2020-11721load_png in loader.c in libsixel.a in libsixel 1.8.6 has an …6.5
• CVE-2020-11722Dungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 all…9.8
• CVE-2020-11723Cellebrite UFED 5.0 through 7.29 uses four hardcoded RSA pri…5.5
• CVE-2020-11725snd_ctl_elem_add in sound/core/control.c in the Linux kernel…7.8
• CVE-2020-11727A cross-site scripting (XSS) vulnerability in the AlgolPlus …6.1
• CVE-2020-11728An issue was discovered in DAViCal Andrew's Web Libraries (A…7.5
• CVE-2020-11729An issue was discovered in DAViCal Andrew's Web Libraries (A…9.8
• CVE-2020-1173A spoofing vulnerability exists in Microsoft Power BI Report…6.8
• CVE-2020-11731The Media Library Assistant plugin before 2.82 for Wordpress…6.1