CVE-2026-47574

NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability where an attacker could cause incorrect resource transfer between spheres. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data...

urllib3: Chunked Deflate streaming can enter an infinite loop

Impact urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading content in chunks instead of loading the entire response body into memory at once. urllib3 can decompress response bodies according to the HTTP Content-Encoding header. When streaming a...

SUSE CVE-2026-102634

SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstraproom fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstraproom values to crash scheduler processes or hang oth...

EUVD-2026-89017

urllib3: HTTPResponse.stream/readchunked buffers an unbounded chunk-size line into memory...

urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

Impact urllib3's streaming API is designed for efficiently handling large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When decoding a chunked-transfer-encoded response, this API reads each chunk's size field by buffering until...

GHSA-VXQ7-64XX-V4GW urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

Impact urllib3's streaming API is designed for efficiently handling large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When decoding a chunked-transfer-encoded response, this API reads each chunk's size field by buffering until...

netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing

A flaw was found in Netty. This vulnerability allows a remote attacker to perform request smuggling attacks due to incorrect parsing of malformed Transfer-Encoding headers. By exploiting this flaw, an attacker can bypass security controls and potentially access sensitive information or manipulate...

Resource Exhaustion

Apache Qpid Proton-J is vulnerable to resource exhaustion. The vulnerability is due to the inability to govern the maximum number of transfer frames per incoming delivery, where the library does not enforce a limit on the number of frames and an authenticated attacker can send deliveries with...

netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing

A flaw was found in Netty. This vulnerability allows a remote attacker to perform request smuggling attacks due to incorrect parsing of malformed Transfer-Encoding headers. By exploiting this flaw, an attacker can bypass security controls and potentially access sensitive information or manipulate...

PT-2026-103097

MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submitted record, including caller-supplied...

PT-2026-103422

Name of the Vulnerable Software and Affected Versions NVIDIA vGPU Virtual GPU Manager for Linux affected versions not specified Description An issue exists where an attacker could cause incorrect resource transfer between spheres. This could lead to code execution, denial of service, escalation o...

CVE-2026-47574: Incorrect Resource Transfer Between Spheres

NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability where an attacker could cause incorrect resource transfer between spheres. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data...

AlmaLinux 9.6 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc (ALMALINUX9.6:CLSA-2026:1787783675)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787783675 advisory. - A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts...

Rocky Linux 9.6 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc (ALMALINUX9.6:CLSA-2026:1787783675)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787783675 advisory. - A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accept...

CentOS Linux 6 [TuxCare] Security Update: haproxy (CENTOS6:CLSA-2026:1776337242)

The CentOS Linux 6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1776337242 advisory. - A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the chunked value were not bein...

Natural Barriers to Quantum Extraction: On the Post-Quantum (In)Security of (O)EKE and Masny-Rindal OT

Encrypted key exchange EKE, introduced by Bellovin and Merritt IEEE S&P 1992, and Masny-Rindal OT, introduced by Masny and Rindal ACM CCS 2019, are highly-efficient methods for compiling essentially any KEM into advanced cryptographic protocols, namely password-authenticated key exchange PAKE and...

CentOS Linux 7 [TuxCare] Security Update: libsoup / libsoup-devel (CENTOS7:CLSA-2026:1787751026)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1787751026 advisory. - A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inpu...

CVE-2026-103042 LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value

LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pdtransmode nccl, allowing unauthenticated attackers to exhaust KV-transfer worker memory. Attackers can call the exposedsetvalue method to store unbounded key-value pairs without siz...

CVE-2026-103042 LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value

LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pdtransmode nccl, allowing unauthenticated attackers to exhaust KV-transfer worker memory. Attackers can call the exposedsetvalue method to store unbounded key-value pairs without siz...

CVE-2026-73256

A flaw was found in Mongoose. A remote, unauthenticated attacker can achieve unauthorized access or bypass security controls through HTTP request smuggling. Due to an error in protocol version validation, Mongoose fails to identify HTTP/1.0 requests and incorrectly processes chunked transfer...