200959 matches found
nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination
A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service...
popt-devel: popt-static: size_t underflow in singleOptionHelp
An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width. A local user who can cause an application to print help under those conditions may cause that application to crash or fail to display help, resulting in a denial of servi...
CVE-2026-107284
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, WebSocketHandler.upgrade aborts a handshake whose Sec-WebSocket-Accept value is missing or invalid but continues into pipeline installati...
CVE-2026-107283
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with ThreadLocalRandom rather than a cryptographically secure random source. Digest...
CVE-2026-107282
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original...
[SECURITY] [DSA 6549-1] xz-utils security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6549-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 07, 2026 https://www.debian.org/security/faq -...
CVE-2026-107363
In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...
CVE-2026-107280
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix such ...
CVE-2026-107279
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...
google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON
A flaw was found in golang-protobuf. The protojson unmarshaling function can enter an infinite loop when parsing certain invalid JSON inputs, specifically when decoding messages containing Any values or when configured to discard unknown fields. A remote attacker can exploit this vulnerability by...
GHSA-G2V6-RQMX-R4W6 vulnerabilities
Vulnerabilities for packages: langfuse, gitlab-rails-ce-fips, commercial-gitlab-rails-ee, nextcloud-server, langfuse-fips, commercial-gitlab-rails-ee-fips...
GHSA-WQ5F-XC86-PV6W vulnerabilities
Vulnerabilities for packages: peerdb-ui, keep-fips, tileserver-gl-fips, langfuse, keep, langfuse-fips, homepage, tileserver-gl...
GHSA-HP3W-G68C-FV3C vulnerabilities
Vulnerabilities for packages: jupyter-base-notebook, graalvm, gitlab-rails-ce-fips, commercial-gitlab-rails-ee, commercial-gitlab-rails-ee-fips...
CVE-2026-97058 vulnerabilities
Vulnerabilities for packages: jupyter-base-notebook, graalvm, gitlab-rails-ce-fips, commercial-gitlab-rails-ee, commercial-gitlab-rails-ee-fips...
GHSA-GXM5-99CW-XJW9 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, commercial-gitlab-rails-ee, gitlab-rails-ce, langfuse-fips, commercial-gitlab-rails-ee-fips...
CVE-2026-74866 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, commercial-gitlab-rails-ee, gitlab-rails-ce, langfuse-fips, commercial-gitlab-rails-ee-fips...
GHSA-PQG4-J6R4-53MV vulnerabilities
Vulnerabilities for packages: code-server, arangodb, renovate, gitlab-rails-ce-fips, commercial-gitlab-rails-ee, gitlab-rails-ce, gemini-cli, commercial-gitlab-rails-ee-fips...
CVE-2026-102422 vulnerabilities
Vulnerabilities for packages: code-server, arangodb, renovate, gitlab-rails-ce-fips, commercial-gitlab-rails-ee, gitlab-rails-ce, gemini-cli, commercial-gitlab-rails-ee-fips...
