CLSA-2026-1786345204 TuxCare security update for org.apache.avro (1 CVE)

TuxCare rebuilt 17 org.apache.avro packages to address 1 CVE. Fixed in 1.8.2-tuxcare.4...

Deserialization Of Untrusted Data

Apache Camel is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to an overly permissive ObjectInputFilter that allows classes such as java.net.URL and java.net.InetAddress during deserialization, which allows an attacker to deliver a crafted Java-serialized payload...

httpd: mod_md: unrestricted OCSP response leads to resource exhaustion

A flaw was found in the modmd module of httpd. When processing OCSP Online Certificate Status Protocol responses from a malicious or compromised OCSP responder, the module fails to enforce proper size limits on the incoming data. This issue leads to memory exhaustion and a denial of service...

Photon OS 5.0: Kafka PHSA-2026-5.0-91-0855

An update of the kafka package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0855. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

RHEL 9 : mod_http2 (RHSA-2026:50572)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:50572 advisory. The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers. Security Fixes: modhttp2:...

Photon OS 5.0: Apache PHSA-2025-5.0-91-0493

An update of the apache package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0493. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

EulerOS 2.0 SP11 : httpd (EulerOS-SA-2026-3070)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are...

EulerOS 2.0 SP11 : httpd (EulerOS-SA-2026-3125)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are...

GHSA-PMHH-3W7G-XQP8 vulnerabilities

Vulnerabilities for packages: elasticsearch-fips, opensearch-fips, elasticsearch, metabase, nextflow, copybara-fips, conductor-fips, spdx-tools-java, jbang, gradle, opensearch, scala, wazuh-indexer, apache-hop, apache-tika-fips, conductor, apache-tika, copybara, apache-hop-fips...

CVE-2026-71497 vulnerabilities

Vulnerabilities for packages: elasticsearch-fips, opensearch-fips, elasticsearch, metabase, nextflow, copybara-fips, conductor-fips, spdx-tools-java, jbang, gradle, opensearch, scala, wazuh-indexer, apache-hop, apache-tika-fips, conductor, apache-tika, copybara, apache-hop-fips...

GHSA-PMHH-3W7G-XQP8 vulnerabilities

Vulnerabilities for packages: opensearch, gradle, apache-tika, nextflow, spdx-tools-java...

CVE-2026-71497 vulnerabilities

Vulnerabilities for packages: opensearch, gradle, apache-tika, nextflow, spdx-tools-java...

CVE-2026-48145

A flaw was found in Apache Thrift C++ bindings. This vulnerability, caused by improper validation of certificates with host mismatch, could allow a remote attacker to disclose sensitive information. Mitigation To mitigate this issue, restrict network access to systems utilizing Apache Thrift C++...

CVE-2026-68481

A flaw was found in Apache CXF. This vulnerability affects the DefaultEncryptingOAuthDataProvider, where revoked access and refresh tokens can still be successfully decrypted and reported as active. This bypasses the intended token revocation process, potentially allowing unauthorized access to...

CVE-2026-50623

A flaw was found in Apache CXF. An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService. Due to a missing 'throw' keyword in the security context check, an unauthenticated network attacker can access the introspection endpoint. This could lead to unauthorized access ...

CVE-2026-50629

A flaw was found in apache-cxf. The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without proper sanitization. A remote attacker could exploit this by injecting arbitrary content, including fake log entries, into the server's log...

CVE-2026-50634

A flaw was found in Apache CXF. The JwsJsonContainerRequestFilter component can be exploited to process metadata that has not been authenticated by an accepted signature. This bypasses the application's security assumption that Content-Type or protected HTTP-header metadata originates from a...

CVE-2026-50630

A flaw was found in apache-cxf. This vulnerability, known as a Carriage Return Line Feed CRLF injection, allows an attacker to manipulate HTTP response headers. By injecting special characters into the 'realm' parameter of the WWW-Authenticate header, an attacker can add arbitrary HTTP headers or...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1x) is affected by HTTP message parser vulnerability due to Apache HttpComponents Core

Summary Apache HttpComponents Core is used by IBM Cloud Pak for Data System 1x to provide HTTP client and server functionality. CVE-2026-54399 affects Apache HttpComponents Core's HTTP/1.1 message parser when processing messages with excessive headers or header lengths, allowing remote attackers ...

CVE-2026-71558

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to b...