CVE-2026-59845

A flaw was found in libssh. When ProxyCommand is used, an unchecked fork failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service...

CVE-2026-59845 Libssh: libssh: denial of service via unchecked proxycommand fork() failure

A flaw was found in libssh. When ProxyCommand is used, an unchecked fork failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service...

CVE-2026-59845

A flaw was found in libssh. When ProxyCommand is used, an unchecked fork failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service...

CVE-2026-59845

A flaw was found in libssh. When ProxyCommand is used, an unchecked fork failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in the ProxyCommand process. An attacker can disrupt local system availability by triggering an unchecked fork failure, which causes signals to be sent across the process tree. This is only exploitable if the...

CVE-2026-15927

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an externalreference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validateexternalregistryurl. A repository...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2755)

According to the versions of the package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via...

ALSA-2026:42828 Important: httpd:2.4 security, bug fix, and enhancement update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: incomplete fix for CVE-2023-38709 CVE-2024-42516 httpd: NULL pointer dereference via specially crafted request CVE-2026-29169 httpd: Apache HTTP Server: Heap-based Buffer...

Important: httpd:2.4 security, bug fix, and enhancement update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: incomplete fix for CVE-2023-38709 CVE-2024-42516 httpd: NULL pointer dereference via specially crafted request CVE-2026-29169 httpd: Apache HTTP Server: Heap-based Buffer...

PT-2026-62459

Name of the Vulnerable Software and Affected Versions Oracle Weblogic Server Proxy Plug-in version 15.1.1.0.0 Description An unauthenticated attacker with network access via HTTP can compromise the Oracle Weblogic Server Proxy Plug-in. This issue allows for the unauthorized creation, deletion, or...

RHEL 8 : httpd:2.4 (RHSA-2026:42828)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42828 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: incomplete fix...

PT-2026-62458

Name of the Vulnerable Software and Affected Versions Oracle Weblogic Server Proxy Plug-in version 12.2.1.4.0 Oracle Weblogic Server Proxy Plug-in version 14.1.2.0.0 Description An unauthenticated attacker with network access via HTTP can compromise the Oracle Weblogic Server Proxy Plug-in. This...

PT-2026-61936

Name of the Vulnerable Software and Affected Versions libssh affected versions not specified Description A flaw exists in the handling of ProxyCommand where a malicious username expanded through the %r variable can inject shell metacharacters. This can lead to the exposure of environment variable...

SUSE SLES15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:3132-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3132-1 advisory. This update for python311 fixes the following issues - CVE-2026-1502: CR/LF bytes not rejected by HTTP client proxy tunnel headers ...

PT-2026-62225

Name of the Vulnerable Software and Affected Versions Netty versions 4.1.0.Final through 4.1.134 Netty versions 4.2.0.Final through 4.2.15 Description The HAProxyMessageDecoder in the codec-haproxy module performs protocol version detection by reading the 13th byte as a signed Java byte and...

GHSA-GCFJ-64VW-6MP9 Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

Summary Axios’ Node.js HTTP adapter can route requests through an attacker-controlled proxy when Object.prototype.proxy is polluted and request configuration is materialized as a regular object before dispatch. Recent axios releases harden merged request config by creating a null-prototype object...

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution in the Node HTTP adapter lib/adapters/http.js, which reads config.proxy through the prototype chain after a request interceptor returns a plain-object...

GHSA-MMX7-HFXF-JPPX Axios: Prototype pollution gadgets can alter axios request construction

Summary axios is vulnerable to read-side prototype-pollution gadgets when Object.prototype has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: axios.get, axios.delete, axios.head, and axios.options read inherited da...

Prototype Pollution

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution in the bodyless method aliases in lib/core/Axios.js, the proxy handling in lib/adapters/http.js, and the paramsSerializer read in...

Permissive List of Allowed Inputs

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Permissive List of Allowed Inputs in the isLoopback and isIPv4Loopback functions of lib/helpers/shouldBypassProxy.js, which require the first IPv4 octet to be 127 and...