27277 matches found
CVE-2026-66069: Missing Authorization
RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, isauthorized/2 uses isauthorizedmonitor for all methods. DELETE resets rabbitcoremetrics:resetauthattemptmetrics. Impact is cosmetic counters only, no log erasure, but inconsistent with rabbitmgmtwmreset.erl...
PT-2026-97562
Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 Description An unauthenticated network attacker can crash a RabbitMQ node with the AMQP 1.0 listener enable...
PT-2026-97560
Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description An issue exists where the is authorized/2 function calls rabbi...
CVE-2026-77762: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from...
PT-2026-97557
Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 4.1.13 RabbitMQ versions prior to 4.2.7 RabbitMQ versions prior to 4.3.0 Description An issue exists where the is authorized/2 function uses is authorized monitor for all methods. This allows a user with the monitori...
CVE-2026-66079: Allocation of Resources Without Limits or Throttling
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parsearrayprimitive/2 for constructor 0x45 list0 returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consumin...
CVE-2026-86350: Inconsistent Interpretation of HTTP Requests
Inconsistent interpretation of HTTP/2 requests 'HTTP Request/Response smuggling' vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from...
TencentOS Server 2: abrt (TSSA-2026:1063)
The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1063 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...
CVE-2026-67219: Allocation of Resources Without Limits or Throttling
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, addbinding/3 parses the routing key as an integer weight N and computes ring positions with lists:seqNextN0, NextN0 + N - 1. validatebinding/2 only checks N = 1 , no upper bound. The resulti...
PT-2026-97582
Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description An administrator with the required tags can crash the node in ...
PT-2026-97580
Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description An issue exists where the add binding/3 function parses the...
CLSA-2026-1790109160 TuxCare security update for @babel (1 CVE)
TuxCare rebuilt 35 @babel packages to address 1 CVE. Fixed in 7.24.5-tuxcare.2...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
SUSE CVE-2026-93492
A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAXHEADERTABLESIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimatel...
SUSE CVE-2026-94184
A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response...
CVE-2026-88004
A flaw was found in Traefik, an open-source HTTP reverse proxy and load balancer. Its entrypoint defenses, designed to sanitize header names, failed to inspect request trailers. This allowed an unauthenticated client to submit malicious header names within HTTP/1.1 chunked or HTTP/2 trailers...
CVE-2026-88008
A flaw was found in Traefik, an open source HTTP reverse proxy and load balancer. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP/2 request that includes specific upgrade headers. If the backend server accepts the upgrade, Traefik enters a raw...
CLSA-2026-1790091092 TuxCare security update for org.springframework (13 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 13 CVEs. Fixed in 5.3.6-tuxcare.2...
USN-8728-2: Linux kernel (Azure) vulnerabilities
It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...