CVE-2026-93562

CVE-2026-93562 is an HTTP request smuggling vulnerability in Netty's HTTP/1 decoder (package io.netty/netty-codec-http). The root cause is incomplete validation of malformed Transfer-Encoding headers, allowing a remote attacker with no privileges to inject arbitrary HTTP requests and potentially ...

CVE-2026-93562 Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls ...

EUVD-2026-83386

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls ...

CVE-2026-93562

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls ...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Special:FacetedSearch process. An attacker can inject arbitrary HTML or JavaScript into the response by crafting a request with malicious cstate parameters that are not properly escaped, leading to...

CVE-2026-67549

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted 1-bit contiguous cmyk tiff is exposed through a native uint1 imagespec, so callers allocate a bit-packed buffer...

CVE-2026-67549 OpenImageIO: TIFF 1-bit CMYK bit conversion heap out-of-bounds write

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted 1-bit contiguous cmyk tiff is exposed through a native uint1 imagespec, so callers allocate a bit-packed buffer...

EUVD-2026-83134

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted 1-bit contiguous cmyk tiff is exposed through a native uint1 imagespec, so callers allocate a bit-packed buffer...

DEBIAN-CVE-2026-93569

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

CVE-2026-81634 affecting package unbound for versions less than 1.26.1-1

CVE-2026-81634 affecting package unbound for versions less than 1.26.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-81642 affecting package unbound for versions less than 1.26.1-1

CVE-2026-81642 affecting package unbound for versions less than 1.26.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-87766 affecting package bubblewrap for versions less than 0.12.0-1

CVE-2026-87766 affecting package bubblewrap for versions less than 0.12.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-89157 affecting package pcre2 for versions less than 10.48-1

CVE-2026-89157 affecting package pcre2 for versions less than 10.48-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-72924 affecting package gh for versions less than 2.101.0-1

CVE-2026-72924 affecting package gh for versions less than 2.101.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-89160 affecting package pcre2 for versions less than 10.48-1

CVE-2026-89160 affecting package pcre2 for versions less than 10.48-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-44950 affecting package libXfont2 for versions less than 2.0.9-1

CVE-2026-44950 affecting package libXfont2 for versions less than 2.0.9-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-77860 affecting package unbound for versions less than 1.26.1-1

CVE-2026-77860 affecting package unbound for versions less than 1.26.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-59679 affecting package libXfont2 for versions less than 2.0.9-1

CVE-2026-59679 affecting package libXfont2 for versions less than 2.0.9-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-82720 affecting package unbound for versions less than 1.26.1-1

CVE-2026-82720 affecting package unbound for versions less than 1.26.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-78227 affecting package unbound for versions less than 1.26.1-1

CVE-2026-78227 affecting package unbound for versions less than 1.26.1-1. An upgraded version of the package is available that resolves this issue...