CVE-2026-78660

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

CVE-2026-78660

The net/http package in the Go programming language contains a vulnerability where the HTTP/2 implementation allows malformed framing-related headers. While these headers do not interfere with HTTP/2 framing, they can be forwarded to an HTTP/1 client when the implementation acts as a reverse prox...

EUVD-2026-95425

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

CVE-2026-78660

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

CVE-2026-78660 HTTP/2 transport accepts malformed framing-related headers in net/http

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

GO-2026-6610 HTTP/2 transport accepts malformed framing-related headers in net/http

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

Important: Red Hat Security Advisory: RHACS 4.11.5 security and bug fix update

Updated images are now available for Red Hat Advanced Cluster Security RHACS, which typically include new features, bug fixes, and/or security patches. See the release notes link in the references section for a description of the fixes and enhancements in this particular release...

Indico: Incomplete Server-Side Request Forgery (SSRF) check

Impact Indico makes outgoing requests to user-provides URLs in various places. This is mostly intentional and part of Indico's functionality, but of course it is never intended to let you access "special" targets such as localhost or cloud metadata endpoints. The previous fix CVE-2026-25738 did n...

Indico: Missing access check in legacy session export API

Impact A legacy API to retrieve session details could be misused to retrieve metadata such as title, description and conveners of a restricted session within without having access to that session, as long as the event itself was accessible. Patches You should to update to Indico 3.3.13 as soon as...

Indico: Cross-Site-Scripting in minutes editor

Impact There is a Cross-Site-Scripting vulnerability in the minute editor conflict UI tha's shown when concurrent edits are made to the same minutes in an event. Patches You should to update to Indico 3.3.13 as soon as possible. See the docs for instructions on how to update. Workarounds - Set...

GHSA-CW24-X4MJ-FW3Q Indico: Cross-Site-Scripting in minutes editor

Impact There is a Cross-Site-Scripting vulnerability in the minute editor conflict UI tha's shown when concurrent edits are made to the same minutes in an event. Patches You should to update to Indico 3.3.13 as soon as possible. See the docs for instructions on how to update. Workarounds - Set...

Indico: Cross-Site-Scripting in link fields

Impact There is a Cross-Site-Scripting vulnerability in fields that allow entering custom URLs. Patches You should to update to Indico 3.3.13 as soon as possible. See the docs for instructions on how to update. Workarounds - Set CSPENABLED = True in indico.conf - this is recommended regardless of...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version v12.1.1.3 Vulnerability Details CVEID:CVE-2026-59270 DESCRIPTION: Spring Security's embedded UnboundID LDAP server UnboundIdContainer unconditionally registers an administrative credential and binds its listener to all...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.75 packages and security update

Red Hat OpenShift Container Platform release 4.14.75 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

Malicious code in kafka-helmsman (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75536e8621da28a0e941bd4a607da879a64ab71214e908992bf14840ed9a20b2 The sdist for kafka-helmsman 99.0.5 is a dependency-confusion placeholder targeting the internal Tesla project name...

Cybersecurity Imperatives Will Demand AI Math

" I think we might lose public key cryptography." Matthew Green The above is from Matthew Green, yesterday, who is a cryptographer at Johns Hopkins. OpenAI released over 700 mathematical proofs as a github repository yesterday. They've since withdrawn 3 of them. The reaction from mathematicians h...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.72 bug fix update

Red Hat OpenShift Container Platform release 4.16.72 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

K000163608: Python vulnerability CVE-2026-0994

Security Advisory Description A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal...

Malicious code in kafka-roller (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4490e03c9b281c985d7cc5c877d359f8f3789a2ec44421602137c461ac4a2a52 The package is published to PyPI under the name kafka-roller with metadata impersonating Tesla's teslamotors/kafka-helmsman project homepage points a...

MAL-2026-17703 Malicious code in kafka-roller (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4490e03c9b281c985d7cc5c877d359f8f3789a2ec44421602137c461ac4a2a52 The package is published to PyPI under the name kafka-roller with metadata impersonating Tesla's teslamotors/kafka-helmsman project homepage points a...