Astra Linux – Vulnerability in JRuby

Before Ruby 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an HTTP Response Splitting attack was possible. An attacker could inject a crafted key and value into an HTTP response for the WEBrick HTTP server...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: scsi: qla2xxx: Fixed an issue where the response queue was consumed excessively in qlaconsumeiocb. The qla24xxprocessresponsequeue function advances the ringptr beyond the head IOCB before dispatching it. By the time...

Astra Linux – Vulnerability in exiv2

In Exiv2, from version 0.27.1 onwards, a malicious HTTP server can cause a denial of service crash due to a NULL pointer dereference by returning a crafted response that lacks a space character...

Astra Linux – Vulnerability in connman

In ConnMan through version 1.44, the lookup string in nsresolv in dnsproxy.c can be NULL or an empty string when the TC Truncated bit is set in a DNS response. This allows attackers to cause a denial of service application crash or potentially execute arbitrary code, as those lookup values lead t...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Before versions 6.9.13-48 and 7.1.2-23, the distributed pixel cache was originally designed to work without a challenge-response authentication model. This has been changed in versions 6.9.13-48 and...

Astra Linux – Vulnerability in Apache2

There is a vulnerability related to HTTP response splitting in several Apache HTTP Server modules, especially on untrusted or compromised backend servers. This issue affects Apache HTTP Server versions from 2.4.66 onwards. Users are recommended to upgrade to version 2.4.67, as this version...

Astra Linux – Vulnerability in libcommons-net-java

Prior to Apache Commons Net 3.9.0, Net’s FTP client trusted the host based on the PASV response by default. A malicious server could redirect the Commons Net code to use a different host, but the user had to connect to the malicious server in the first place. This could result in the leakage of...

Astra Linux – Vulnerability in Apache2

An HTTP response smuggling vulnerability exists in the Apache HTTP Server via modproxyuwsgi. This issue affects the Apache HTTP Server: from version 2.4.30 through 2.4.55. Special characters in the origin response header can cause the response forwarded to the client to be truncated or split...

Astra Linux – Vulnerability in golang-golang-x-net, golang-1.15

In Go, before versions 1.15.12 and 1.16.x, and before version 1.16.4, net/http allowed remote attackers to cause a denial of service panic through a large header sent to ReadRequest or ReadResponse. This issue can affect the Server, Transport, and Client components in certain configurations...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: eir: Fixed possible crashes when using eircreateadvdata. eircreateadvdata may attempt to add EIRFLAGS and EIRTXPOWER without checking whether those values are compatible with the structure...

Astra Linux – Vulnerability in freeipmi

In FreeIPMI, the ipmi-oem command before version 1.6.17 has exploitable buffer overflows in the response messages. The Intelligent Platform Management Interface IPMI specification defines a set of interfaces for platform management. This specification is implemented by a large number of hardware...

Security update for cups

This update for cups fixes the following issue: CVE-2026-41079: crafted SNMP response can lead to stack-based out-of-bounds read and sensitive memory disclosure bsc1263116. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

SUSE-SU-2026:4447-1 Security update for cups

This update for cups fixes the following issue: - CVE-2026-41079: crafted SNMP response can lead to stack-based out-of-bounds read and sensitive memory disclosure bsc1263116...

K000163542: undici vulnerability CVE-2026-6733

Security Advisory Description Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the...

EUVD-2026-92135

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets sslverifypeer to FALSE, which is passed to CURLOPTSSLVERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests...

CVE-2026-104956: Improper Neutralization of Special Elements in Data Query Logic

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

CVE-2026-77803: Inconsistent Interpretation of HTTP Requests

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present,...

PT-2026-105987

Name of the Vulnerable Software and Affected Versions Progress Telerik Fiddler Classic for Windows versions prior to 6.0.20262.10021 Description HTTP request smuggling is possible in the proxy request forwarding component. This occurs when requests containing multiple Content-Length headers with...

PT-2026-105988

Name of the Vulnerable Software and Affected Versions Progress Telerik Fiddler Classic for Windows versions prior to 6.0.20262.10021 Description Front-end request desynchronization is possible in the proxy request forwarding component. When a request contains both Content-Length and...

CVE-2026-77802: Inconsistent Interpretation of HTTP Requests

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...