CVE-2026-109125

In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold 0' configurations not a default configuration. If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but i...

PT-2026-120504

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.26.2 Description An observable cache-level side-channel exists when the unwanted-reply-threshold is configured to a value greater than 0. This occurs when a response-like UDP datagram reaches the upstream...

Linux Distros Unpatched Vulnerability : CVE-2026-109125

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold 0' configurations...

PT-2026-120780

Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and...

CVE-2026-85555

DNSSEC validation bypass and cache poisoning in PowerDNS Recursor via out-of-band NS resolution...

PT-2026-120745

Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body dat...

PowerDNS -- Multiple vulnerabilities

PowerDNS reports: CVE-2026-73206: A crafted DNS packet can cause a denial of service decompressing the DNS names in the packet CVE-2026-73205: A malicious client can cause too many TCP connections in TIMEWAIT state CVE-2026-85555: DNSSEC validation bypass and cache poisoning in PowerDNS Recursor...

Gitlab -- vulnerabilities

Gitlab reports: Integer Overflow issue in Regular Expression Compiler impacts GitLab CE/EE Improper Authentication issue in OmniAuth-to-LDAP auto-linking email lookup impacts GitLab CE/EE Cache Poisoning issue in OAuth/OIDC discovery endpoints impacts GitLab CE/EE Improper Access Control issue in...

Unbound -- Multiple vulnerabilities

NLNetLabs reports: This release consolidates security fixes for issues reported over a period of time. CVE-2026-97206, DoQ path-migration can lead to use-after-free on multi-threaded deployments. CVE-2026-50106, Possible insecure NXDOMAIN for non-existing records under a configured island trust...

CVE-2026-108088

This vulnerability affects all versions of Apache Cocoon , which is a retired project. The issue is a cross-user cache poisoning (CWE-524) where cached values containing sensitive information from one user could be served to other users in a multi-user application. Because the project is retired,...

CVE-2026-108088 Apache Cocoon: Cross-user cache poisoning

UNSUPPORTED WHEN ASSIGNED Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users. This issue affects Apache Cocoon: all versions. As this project ...

CVE-2026-105298

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...

CVE-2026-105298

Versions of Pingora prior to 0.9.0 are vulnerable to a security issue where the software accepts HTTP/2 requests with a Host header that differs from the :authority pseudo-header. The root cause involves the server failing to compare these values or reject userinfo in the authority, violating RFC...

CVE-2026-105298 Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...

EUVD-2026-104695

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...

CVE-2026-105298

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...

CVE-2026-105298 Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value...

JFrog Artifactory < 7.146.28 Cache Poisoning

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.146.28. It is, therefore, affected by a cache poisoning vulnerability in the cached artifact metadata. An authenticated, remote attacker can exploit this to potentially cause...

CVE-2026-111750

A flaw was found in aiohttp. When running with the pure Python parser instead of compiled extensions, the parser accepts ambiguous HTTP Hypertext Transfer Protocol request framing. An unauthenticated remote attacker could exploit this flaw by sending specially crafted requests through an...

python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

A vulnerability was discovered in Tornado where it improperly handles HTTP requests containing duplicate Transfer-Encoding: chunked headers. When duplicate Transfer-Encoding headers are present in an incoming request, Tornado ignores them and treats the request as body-less, leaving the chunked...