30571 matches found
CVE-2026-73494
blaze is a Scala library for asynchronous network I/O pipelines. Five HTTP/1.1 conformance laxities in its hand-written Java parser (http/src/main/java/org/http4s/blaze/http/parser/) accept malformed requests—invalid tchar header names, obs-fold lines, unsupported Transfer-Encoding values, duplic...
CVE-2026-73494 blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a...
CVE-2026-73494 blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a...
CVE-2026-55866 SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected
SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIPHASPERMISSION instead of PERMISSIONSHIPCONDITIONALPERMISSION or PERMISSIONSHIPNOPERMISSION because checkRequestToKey and...
CVE-2026-55866
SpiceDB (open-source permissions database), versions 1.34.0 through 1.54.0 , contains a cache-key collision bug in internal/dispatch/keys/computed.go where checkRequestToKey() and checkRequestToKeyWithCanonical() omit CheckHints when building dispatch Check cache keys. Under specific concurrency ...
CVE-2026-55866 SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected
SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIPHASPERMISSION instead of PERMISSIONSHIPCONDITIONALPERMISSION or PERMISSIONSHIPNOPERMISSION because checkRequestToKey and...
EUVD-2026-77689
SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIPHASPERMISSION instead of PERMISSIONSHIPCONDITIONALPERMISSION or PERMISSIONSHIPNOPERMISSION because checkRequestToKey and...
CVE-2026-55866 SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected
SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIPHASPERMISSION instead of PERMISSIONSHIPCONDITIONALPERMISSION or PERMISSIONSHIPNOPERMISSION because checkRequestToKey and...
CVE-2026-90801
A security flaw has been discovered in GNU Binutils 2.47. This impacts the function cachebwrite of the file bfd/cache.c of the component ld. The manipulation of the argument nbytes results in buffer overflow. The attack requires a local approach. The exploit has been released to the public and ma...
CVE-2026-54156
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global galreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/serversecurechannellayer.ts records nonces from OpenSecureChannelRequest and CreateSessi...
OESA-2026-3868 ruby security update
Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks such as Perl. Security Fixes: An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder...
OESA-2026-3724 python-gunicorn security update
GunicornGreen Unicorn is a Python WSGI HTTP Server for UNIX. It's a pre-fork worker model ported from Ruby's Unicorn project. The Gunicorn server is broadly compatible with various web frameworks, simply implemented, light on server resource usage, and fairly speedy. Security Fixes: Gunicorn...
OESA-2026-3718 golang security update
. Security Fixes: Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.CVE-2026-33818 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client...
CVE-2026-90801 GNU Binutils ld cache.c cache_bwrite buffer overflow
A security flaw has been discovered in GNU Binutils 2.47. This impacts the function cachebwrite of the file bfd/cache.c of the component ld. The manipulation of the argument nbytes results in buffer overflow. The attack requires a local approach. The exploit has been released to the public and ma...
CVE-2026-90801
A buffer overflow vulnerability was identified in GNU Binutils 2.47 , specifically in the function cache_bwrite within bfd/cache.c of the ld (linker) component. Manipulation of the nbytes argument triggers the overflow. The attack vector is local , requiring low privileges and no user interaction...
CVE-2026-54156 node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global galreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/serversecurechannellayer.ts records nonces from OpenSecureChannelRequest and CreateSessi...
EUVD-2026-77624
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global galreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/serversecurechannellayer.ts records nonces from OpenSecureChannelRequest and CreateSessi...
CVE-2026-54156 node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global galreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/serversecurechannellayer.ts records nonces from OpenSecureChannelRequest and CreateSessi...
CVE-2026-54156 node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global galreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/serversecurechannellayer.ts records nonces from OpenSecureChannelRequest and CreateSessi...