tomcat: Apache Tomcat: HTTP/2 request smuggling due to header mix-up

A flaw was found in Apache Tomcat. This vulnerability, identified as HTTP Request/Response smuggling, stems from an inconsistent interpretation of HTTP/2 requests. A regression in a prior security fix can cause request headers to be mixed up. This could allow a remote attacker to bypass security...

tomcat: Apache Tomcat: Denial of Service via malformed HTTP/2 request

A flaw was found in Apache Tomcat. An incomplete cleanup vulnerability allows a remote attacker to send a malformed HTTP/2 request. This can potentially cause a denial of service, leading to one request from another user failing...

OPENSUSE-SU-2026:21864-1 Security update for mbedtls-2

This update for mbedtls-2 fixes the following issues: Changes in mbedtls-2: - CVE-2025-52496: race condition in AESNI support detection, AES key disclosure / GCM forgery in multithreaded programs boo1245810 - CVE-2025-59438: padding oracle through timing of cipher error reporting boo1252454...

CVE-2026-18924

A flaw was found in libcurl. When libcurl handles HTTP/2 Server Push streams and the parent handle shares connections, a use-after-free vulnerability can occur during the cleanup process. This could lead to application crashes, resulting in a denial of service. Mitigation Disable HTTP/2 Server Pu...

CLSA-2026-1789566692 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 11 @react-native-community packages to address 1 CVE. Fixed in 15.1.3-tuxcare.2...

Security update for distribution

This update for distribution fixes the following issues: Security issues fixed: CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header bsc1260283. CVE-2026-33540: information disclosure via improper validation of authentication...

SUSE-SU-2026:4212-1 Security update for distribution

This update for distribution fixes the following issues: Security issues fixed: - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header bsc1260283. - CVE-2026-33540: information disclosure via improper validation of authenticati...

Uncaught Exception

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Uncaught Exception via the reply.trailer function when handling HTTP/2 trailer responses. An attacker can cause the server process to crash and terminate all active requests by sending ...

CVE-2026-92081

A flaw was found in fastify. When a route registers a response trailer and is served over HTTP/2, fastify incorrectly sets the 'Transfer-Encoding: chunked' header. This leads to an unhandled exception in Node.js, causing the server process to crash and resulting in a Denial of Service DoS. A...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the JWK.importkey method, whose keyops duplicate detection rescans the whole array for every element and enforces no size limit, making the check On^2 over untrusted parsed JWK data. An attacker can...

CVE-2026-92081

fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while...

CVE-2026-92081

fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while...

CVE-2026-92081 fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while...

CVE-2026-92081

fastify (a Node.js web framework) versions before 5.12.5 are vulnerable to a Denial of Service when a route registers a response trailer via reply.trailer() and is served over HTTP/2 . The root cause is that fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on...

TencentOS Server 2: compat-glibc (TSSA-2026:1019)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1019 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

PT-2026-93404

Name of the Vulnerable Software and Affected Versions fastify versions prior to 5.12.5 Description When a route registers a response trailer using the reply.trailer function and is served over HTTP/2, the framework unconditionally sets the Transfer-Encoding: chunked header. Because this header is...

CVE-2026-86043: Incorrect Authorization

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncatedbody signal is derived from...

PT-2026-93918

Name of the Vulnerable Software and Affected Versions Skipper versions prior to 0.27.37 Description Skipper is an HTTP router and reverse proxy for service composition. The opaAuthorizeRequestWithBody filter can authorize oversized requests by incorrectly signaling the truncation state to the Ope...

PT-2026-93974

A vulnerability in SSL/TLS certificate parsing in the Snort 2 Detection Engine of Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause the Snort 2 Detection Engine to restart. This vulnerability is due to incomplete validation of the SSL...

CVE-2026-20290: Buffer Access with Incorrect Length Value

A vulnerability in SSL/TLS certificate parsing in the Snort 2 Detection Engine of Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause the Snort 2 Detection Engine to restart. This vulnerability is due to incomplete validation of the SSL...