AZL-96984 CVE-2026-54789 affecting package mod_auth_openidc 2.4.14.2-2

modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of...

CVE-2026-54789

modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of...

CVE-2026-54789 mod_auth_openidc has out-of-bounds read and write in state cookie parsing

modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of...

CVE-2026-54789

mod_auth_openidc (Apache 2.x OpenID Connect Relying Party module) prior to 2.4.19.4 contains an out-of-bounds read and one-byte out-of-bounds write in oidc_state_cookies_parse_token() (src/state.c). The loop scanning for = in a cookie token does not stop at the string terminator, and the cookie !...

EUVD-2026-64000

modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of...

CVE-2026-54789 mod_auth_openidc has out-of-bounds read and write in state cookie parsing

modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of...

Exploit for Memory Allocation with Excessive Size Value in Apache Http_Server

CVE-2026-49975 HTTP/2 Bomb ★ CVE-2026-49975 HTTP/2 Bomb PoC ★...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102090)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102090 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctpunpackcookie only...

Linux Distros Unpatched Vulnerability : CVE-2026-63481

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in...

CVE-2026-49436

LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint POST /api/v2/bulk/links accepts URLs without any format validation, allowing an authenticated user to store a javascript: URI. The stored URI is later rendered verbatim as an href in Blad...

CVE-2026-49436

LinkAce (a self-hosted link archive) is vulnerable to stored XSS via its Bulk Link API endpoint (POST /api/v2/bulk/links). Prior to version 2.5.7 , the endpoint accepts URLs without format validation, allowing an authenticated user to store a javascript: URI. The stored URI is rendered verbatim a...

EUVD-2026-63686

LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint POST /api/v2/bulk/links accepts URLs without any format validation, allowing an authenticated user to store a javascript: URI. The stored URI is later rendered verbatim as an href in Blad...

USN-8655-1 async-http-client vulnerability

It was discovered that AsyncHttpClient did not properly verify that the responding host was allowed to set cookies for a given domain in its ThreadSafeCookieStore. An attacker could use this to plant cookies scoped to unrelated domains, which would then be sent on later requests to those domains...

GHSA-QQFF-5854-PX68 vouch-proxy has an Unbounded Multipart Cookie Allocation DoS

Unbounded Multipart Cookie Allocation DoS in vouch-proxy Summary vouch-proxy v0.47.2 contains an unauthenticated remote denial-of-service vulnerability in its multipart cookie reassembly logic. The /validate endpoint parses the total cookie part count directly from the attacker-controlled cookie...

CVE-2026-63481

Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...

DEBIAN-CVE-2026-63481

Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...

CVE-2026-63481 Hurl: Cookies in Cookies section leak when redirecting to a different host

Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...

CVE-2026-63481

Hurl (a command-line tool for running and testing HTTP requests from plain-text files) is vulnerable to cookie leakage on cross-host redirects in versions 8.0.1 and earlier . The redirect handler in packages/hurl/src/http/client.rs correctly strips Authorization and Cookie headers when the redire...

CVE-2026-63481 Hurl: Cookies in Cookies section leak when redirecting to a different host

Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...

CVE-2026-63481

Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...