EUVD-2026-89001

Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...

CVE-2026-35189

A vulnerability exists in OpenSSL where a certificate containing numerous nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth during a TLS handshake. When OpenSSL caches these X.509 extensions, it can allocate hundreds of MiB of resident memory from a certificate u...

CVE-2026-35189

Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.35 packages and security update

Red Hat OpenShift Container Platform release 4.21.35 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

ROOT-APP-GOBINARY-CVE-2024-45337 CVE-2024-45337 in golang.org/x/crypto - Patched by Root

Root has patched CVE-2024-45337 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available...

CVE-2026-97149

A flaw was found in OpenStack Swift's tempurl middleware. A TempURL is a signed, time-limited link that should allow access to only one object. The signature does not cover extra request headers, and Swift did not block the X-Copy-From header on these signed upload requests. An attacker who alrea...

[SECURITY] [DLA 4801-1] swift security update

Debian LTS Advisory DLA-4801-1 [email protected] https://www.debian.org/lts/security/ Carlos Henrique Lima Melara September 29, 2026 https://wiki.debian.org/LTS Package : swift Version : 2.30.1-0+deb12u3 CVE ID : CVE-2026-71191 CVE-2026-97149 Debian Bug : 1142972 1148834 Two...

CVE-2026-35189: Allocation of Resources Without Limits or Throttling

Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...

Amazon Linux 2 : python3-tornado (ALAS-2026-3924)

The version of python3-tornado installed on the remote host is prior to 5.0.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3924 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses...

Important: python-tornado

Issue Overview: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the...

CVE-2026-84783

Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. Impact summary: A remote, unauthenticated peer could crash a multi-threaded TLS client, or a multi-threaded TLS server...

CVE-2026-102630: Use of Less Trusted Source

UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect JavaScript asset loading ...

CVE-2026-35189: Allocation of Resources Without Limits or Throttling

Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...

Linux Distros Unpatched Vulnerability : CVE-2026-35189

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions...

Amazon Linux 2 : python-tornado (ALAS-2026-3925)

The version of python-tornado installed on the remote host is prior to 4.2.1-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3925 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses...

Oracle Linux 10 : python-cryptography (ELSA-2026-71658)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-71658 advisory. 43.0.0-4 - Fix CVE-2026-69249: add X.509 signature validation budget Tenable has extracted the preceding description block directly from the Oracle Linux...

Linux Distros Unpatched Vulnerability : CVE-2026-94286

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients. CVE-2026-94286...

PT-2026-102645

🚨 CVE-2026-102630 UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect...

CVE-2026-67987

crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions in think-tag response parsing on Ruby 3.1.x. A malicious or anomalous model response containing many unterminated tags can cause excessive CPU consumption in t...