PT-2026-100328

Security vulnerability affects the airflow-2 package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-95420

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A flaw exists in the HTTP/2 codec when converting HTTP/1 CONNECT requests to HTTP/2. The component incorrectly utilizes the Host header instead of the CONNECT authority-form request-target to...

CVE-2026-93492: Undefined Security Weakness

A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAXHEADERTABLESIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimatel...

openSUSE 16: libmbedcrypto7 / libmbedcrypto7-x86-64-v3 / libmbedtls14 / etc (openSUSE-SU-2026:21864-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21864-1 advisory. Changes in mbedtls-2: - CVE-2025-52496: race condition in AESNI support detection, AES key disclosure / GCM forgery in multithreaded programs...

CVE-2026-71418: Inefficient Algorithmic Complexity

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, DNS-over-HTTP/2 processing in rust/src/http2/http2.rs retains previously processed HTTP/2 DATA frame contents instead of clearing the internal buffer...

PT-2026-100652

Security vulnerability affects the airflow-2 package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100846

Security vulnerability affects the airflow-2 package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101356

Security vulnerability affects the airflow-2 package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101147

Security vulnerability affects the airflow-2 package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-95511

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A flaw in the HTTP/2 stack allows a remote attacker to inject prohibited characters, including NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validatio...

CVE-2026-93567: Improper Input Validation

A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leadi...

CVE-2026-93568: Improper Input Validation

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical...

CVE-2026-93579: Undefined Security Weakness

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...

PT-2026-100922

Security vulnerability affects the airflow-2 package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-95422

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description An issue exists in the HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request contains both an absolute-form request-target and a conflicting Host header, the system incorrectly prioritize...

PT-2026-95409

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An out-of-bounds read exists in the gptp mi qualify announce function within subsys/net/l2/ethernet/gptp/gptp mi.c. The issue occurs when processing the Path Tra...

PT-2026-101444

Security vulnerability affects the airflow-2 package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101530

Security vulnerability affects the airflow-2 package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101581

Security vulnerability affects the airflow-2 package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-61550: Missing Authorization

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...