CLSA-2026-1792449353 TuxCare security update for http-proxy-middleware (2 CVEs)

TuxCare rebuilt http-proxy-middleware to address 2 CVEs. Fixed in 3.0.5-tuxcare.1...

CVE-2026-111065

A flaw was found in aiohttp. An integer overflow in the processing of HTTP Max-Age directives can prevent connections from closing as intended. A remote attacker could exploit this vulnerability to exhaust the connection pool, leading to a temporary Denial of Service DoS...

GO-2026-6777 Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder in github.com/bishopfox/sliver

Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTPS Listener PNG Decoder in github.com/bishopfox/sliver...

CVE-2026-111750

A flaw was found in aiohttp. When running with the pure Python parser instead of compiled extensions, the parser accepts ambiguous HTTP Hypertext Transfer Protocol request framing. An unauthenticated remote attacker could exploit this flaw by sending specially crafted requests through an...

CVE-2026-111749

A flaw was found in aiohttp. When processing HTTP cookies, a response from an untrusted subdomain can remove the Host-Only attribute from an existing parent-domain cookie. This vulnerability allows an attacker controlling a subdomain to bypass domain isolation protections, potentially exposing...

curl: curl reuses an HTTPS connection when a response is already buffered in the TLS stack

curl master 15292ed75, 8.23.1-DEV reuses an idle HTTP/1.1-over-TLS connection even when a complete extra response is already buffered in OpenSSL/GnuTLS. The ef6b17cf1 fix only polls the socket: Curlcpoolconnseemshealthy lib/conncache.c:1073, called from lib/url.c:1071 uses Curlconnisalive, and...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unsupported HTTP methods on static paths

A flaw was found in kin-openapi. An unauthenticated remote attacker can cause a Denial of Service DoS by sending requests with unsupported or non-canonical HTTP methods to an existing static path. Because the application encounters an unhandled panic before authentication is evaluated, these...

CVE-2026-48932

A flaw was found in the Node.js HTTP client. This vulnerability can cause a request desynchronization in Node.js-based forwarding proxies. A remote attacker could exploit this by sending crafted HTTP requests where the Node.js client omits certain headers from being visible to the proxy, while...

CVE-2026-85251

A flaw was found in the Apache Camel HTTP component. This flaw leads to information disclosure when the component is configured to automatically follow HTTP redirects. The client improperly forwards sensitive authentication credentials, such as OAuth bearer tokens and basic authentication...

Security Bulletin: The Pulse App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Pulse App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-93748 DESCRIPTION: http-cache-semantics...

CVE-2026-80343

A flaw was found in Apache Camel's Netty HTTP component. Due to inconsistent case-sensitivity handling, security constraint checks evaluate requested URL paths using case-sensitive matching while endpoint dispatch does not. A remote, unauthenticated attacker can exploit this discrepancy by alteri...

CVE-2026-78164

A flaw was found in Apache Camel HTTP producer components. When processing messages that override destination addresses, the service improperly evaluates user-controlled header values through its internal configuration resolver. A remote attacker can exploit this vulnerability by submitting...

CVE-2026-95101

A flaw was found in NGINX. When HTTP/3 is used with proxy request buffering enabled, an unauthenticated remote attacker can inject arbitrary data into proxied requests. This vulnerability allows an attacker to manipulate traffic forwarded to backend servers, compromising data integrity. Mitigatio...

CVE-2026-78222

A flaw was found in NGINX. A remote attacker, by sending a specially crafted HTTP response to ngx.fetch, can cause an NGINX worker to crash when trusted JavaScript attempts to read the Response.statusText. This vulnerability requires the attacker to have control or influence over the fetched HTTP...

DoS (Denial of Service) io.netty:netty-codec-http Dependency in Crowd Data Center

This High severity DoS Denial of Service vulnerability was introduced in version 7.2.0 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to expose assets in...

DoS (Denial of Service) io.netty:netty-codec-http Dependency in Crowd Data Center

This High severity DoS Denial of Service vulnerability was introduced in version 7.2.0 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to expose assets in...

DoS (Denial of Service) org.apache.tomcat:tomcat-coyote Dependency in Crowd Data Center

This High severity DoS Denial of Service vulnerability was introduced in version 7.2.0 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to expose assets in...

DoS (Denial of Service) org.apache.httpcomponents.core5:httpcore5 Dependency in Crowd Data Center

This High severity DoS Denial of Service vulnerability was introduced in version 7.2.0 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to expose assets in...

DoS (Denial of Service) org.apache.httpcomponents.core5:httpcore5-h2 Dependency in Crowd Data Center

This High severity DoS Denial of Service vulnerability was introduced in version 7.2.0 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to expose assets in...

MITM (Man-in-the-Middle) axios Dependency in Crowd Data Center

This High severity MITM Man-in-the-Middle vulnerability was introduced in version 7.2.0 of Crowd Data Center. This MITM Man-in-the-Middle vulnerability, with a CVSS Score of 7.2 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N allows an unauthenticated attacker to potentially...