4551 matches found
openSUSE 16 Security Update : c-ares (openSUSE-SU-2026:21721-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21721-1 advisory. Updat to c-ares 1.36.8. - CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via aresgetaddrinfo over...
CVE-2026-84382
HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iterbytes or aiterbytes yields bounded pieces to the application. A 64 KiB compressed chunk can expa...
CVE-2026-84382
A flaw was found in httpx2, a Python HTTP client. The content decoders in httpx2 fully inflate compressed network chunks such as gzip, deflate, br, or zstd before yielding bounded pieces to the application. This can lead to a small compressed chunk expanding significantly in memory, for example, ...
DoS (Denial of Service) io.netty:netty-codec-http Dependency in Confluence Data Center
This High severity DoS Denial of Service vulnerability was introduced in versions 7.4.0, 7.13.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vect...
CVE-2026-40203
A flaw was found in dovecot where, when IMAP compression is enabled, the system reuses the same compression state across responses within a session. This allows a remote attacker, who can send mail to a user and monitor the sizes of their IMAP traffic, to potentially deduce the content of small...
CVE-2026-52687
A flaw was found in dovecot. A remote attacker with valid credentials can exploit this vulnerability by selecting a compression algorithm for the IMAP connection that requires a large amount of memory for decompression. By opening several such connections, the attacker can exhaust the process's...
MGASA-2026-0356 Updated perl-Mojolicious packages fix a security vulnerability
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle...
Updated perl-Mojolicious packages fix a security vulnerability
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle...
Updated c-ares packages fix security vulnerabilities
Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via aresgetaddrinfo over TCP. CVE-2026-33630 CPU-exhaustion denial of service via unbounded DNS name compression pointer chains. CVE-2026-69184 Memory-amplification denial of service via unvalidated DNS header...
Important: Red Hat Security Advisory: compat-libtiff3 security update
An update for compat-libtiff3 is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
RHEL 7 : compat-libtiff3 (RHSA-2026:61657)
The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:61657 advisory. The libtiff3 package provides libtiff 3, an older version of libtiff library for manipulating TIFF Tagged Image File Format image format files. This...
[SECURITY] [DLA 4761-1] libnet-dns-perl security update
Debian LTS Advisory DLA-4761-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin August 30, 2026 https://wiki.debian.org/LTS Package : libnet-dns-perl Version : 1.29-1+deb11u1 1.36-1+deb12u1 CVE ID : CVE-2026-64194 Debian Bug : 1142503 Steffen Ullrich discovered that...
Debian dla-4761 : libnet-dns-perl - security update
The remote Debian 11 / 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4761 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4761-1 [email protected]...
SUSE CVE-2026-40203
When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail and other mail in the same mailbox. An attacker that can send mail to a user and can also observe the sizes of that user's IMAP traffic can...
SUSE CVE-2026-52687
An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. The memory limit of the process is reached with only a few connections, terminating the process and all...
Linux Distros Unpatched Vulnerability : CVE-2026-40203
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail an...
Unity Linux 20.1070e Security Update: unbound (UTSA-2026-035859)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-035859 advisory. NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to perform name compression...
Linux Distros Unpatched Vulnerability : CVE-2026-52687
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, a...
SUSE-SU-2026:3872-1 Security update for libcares2
This update for libcares2 fixes the following issues: - CVE-2026-33630: Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via aresgetaddrinfo over TCP bsc1270416. - CVE-2026-69184: CPU-exhaustion denial of service via unbounded DNS name compression pointer...
