GHSA-GX3X-VQ4P-MHHV cert-manager-controller DoS via Specially Crafted DNS Response

Impact The cert-manager-controller performs DNS lookups during ACME DNS-01 processing for zone discovery and propagation self-checks. By default, these lookups use standard unencrypted DNS. An attacker who can intercept and modify DNS traffic from the cert-manager-controller pod can insert a...

PT-2026-6308

Name of the Vulnerable Software and Affected Versions cert-manager versions 1.18.0 through 1.18.4 cert-manager versions 1.19.0 through 1.19.2 Description cert-manager simplifies the process of obtaining, renewing, and using certificates in Kubernetes clusters. The cert-manager-controller performs...

PT-2026-6430

Impact The cert-manager-controller performs DNS lookups during ACME DNS-01 processing for zone discovery and propagation self-checks. By default, these lookups use standard unencrypted DNS. An attacker who can intercept and modify DNS traffic from the cert-manager-controller pod can insert a...

CBL Mariner 2.0 Security Update: CBL-Mariner Releases (CVE-2025-55753)

The version of CBL-Mariner Releases installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-55753 advisory. - An integer overflow in the case of failed ACME certificate renewal leads, after a number of...

Cloudflare Fixes ACME Validation Bug Allowing WAF Bypass to Origin Servers

Cloudflare has addressed a security vulnerability impacting its Automatic Certificate Management Environment ACME validation logic that made it possible to bypass security controls and access origin servers. "The vulnerability was rooted in how our edge network processed requests destined for the...

esi-acme (>=0.1.0.dev72, <=0.2.0rc2) potentially affected by CVE-2026-23528 via distributed (2.25.0)

distributed PYPI version 2.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - esi-acme =0.1.0.dev72, =0.2.0rc2 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

esi-acme (2023.12.0), nwp-consumer (>=0.1.26, <=0.1.29) potentially affected by CVE-2026-23528 via distributed (2023.12.0)

distributed PYPI version 2023.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - esi-acme 2023.12.0 - nwp-consumer =0.1.26, =0.1.29 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

dask-cuda (>=23.4.0a230405, <=23.8.0a230605), dask-sql (2023.4.0) +5 more potentially affected by CVE-2026-23528 via distributed (2023.3.2.1)

distributed PYPI version 2023.3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - dask-cuda =23.4.0a230405, =0.0.1, =3.0.40, =3.1.3 Source cves: CVE-2026-23528 Source advisory: OSV:GHSA-C336-7962-WFJ2...

analysis-tools (0.2.1), esi-acme (>=2022.11.0, <=2022.12.0) +2 more potentially affected by CVE-2026-23528 via distributed (2022.10.2)

distributed PYPI version 2022.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - analysis-tools 0.2.1 - esi-acme =2022.11.0, =0.1.0b1, =0.1.0 - simpeg-drivers 0.1.0b1 Source cves: CVE-2026-23528 Source advisory:...

OESA-2026-1064 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: An integer overflow vulnerability was found in Apache HTTP Server versions 2.4.30 to 2.4.66. In case of failed ACME certificate renewal, after a number of failures 30 days in default configurations, the...

CVE-2026-22045

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. This vulnerability exists in the ACME TLS-ALPN fast path, where unauthenticated clients can exploit it. By initiating numerous connections and sending a minimal ClientHello with "acme-tls/1" before ceasing communication, a...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the ACME TLS certificates' automatic generation. An attacker can exhaust system resources by opening multiple connections, sending minimal ClientHello messages with acme-tls/1, an...

Allocation of Resources Without Limits or Throttling

Overview github.com/traefik/traefik/v2/pkg/server/router/tcp is a modern HTTP reverse proxy and load balancer that makes deploying microservices easy. Traefik integrates with your existing infrastructure components Docker, Swarm mode, Kubernetes, Marathon, Consul, Etcd, Rancher, Amazon ECS, ... a...

CVE-2026-22045

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.35 and 3.6.7, there is a potential vulnerability in Traefik ACME TLS certificates' automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up go routines and file descriptors indefinitely when the...

GHSA-CWJM-3F7H-9HWQ Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall

Impact There is a potential vulnerability in Traefik ACME TLS certificates' automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up goroutines and file descriptors indefinitely when the ACME TLS challenge is enabled. A malicious client can open many...

Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall

Impact There is a potential vulnerability in Traefik ACME TLS certificates' automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up goroutines and file descriptors indefinitely when the ACME TLS challenge is enabled. A malicious client can open many...

CVE-2026-22045

Summary: CVE-2026-22045 affects Traefik’s ACME TLS-ALPN fast path. When ACME TLS challenge is enabled, an unauthenticated client can open many connections and stall the ClientHello with acme-tls/1, causing goroutines and file descriptors to be tied up indefinitely and leading to DoS at the entryp...

CVE-2026-22045 Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.35 and 3.6.7, there is a potential vulnerability in Traefik ACME TLS certificates' automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up go routines and file descriptors indefinitely when the...

CVE-2026-22045

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.35 and 3.6.7, there is a potential vulnerability in Traefik ACME TLS certificates' automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up go routines and file descriptors indefinitely when the...

CVE-2026-22045: Allocation of Resources Without Limits or Throttling

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.35 and 3.6.7, there is a potential vulnerability in Traefik ACME TLS certificates' automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up go routines and file descriptors indefinitely when the...