Linux Distros Unpatched Vulnerability : CVE-2026-64535

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a diges...

PT-2026-64858

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT FAILED before nvmet req uninit in digest error path In nvmet tcp try recv ddgst, when a data digest mismatch is detected, nvmet req uninit is called unconditionally. However, if the command arrived via the...

Improper Authentication

Jetty HTTP Client is vulnerable to Improper Authentication. The vulnerability is due to the use of ISO-8859-1 encoding when computing Digest authentication response hashes, which replaces all non-Latin-1 characters with ?, allowing an attacker who knows a victim's username to bypass Digest...

CVE-2026-54763

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. The BasicAuth, DigestAuth, and ForwardAuth middlewares in Traefik do not correctly treat underscore-variant header names. This allows a remote attacker to inject a specially crafted header that bypasses Traefik's security...

openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()

A flaw was found in OpenSSL. When processing a specially crafted PKCS7 or S/MIME Secure/Multipurpose Internet Mail Extensions signed message, a heap use-after-free vulnerability in the PKCS7verify function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an emp...

Incorrect Implementation of Authentication Algorithm

Overview Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm due to lossy ISO-8859-1 encoding in the digest hash computation. An attacker can log in as a user with a non-Latin-1 password by supplying a collision password that replaces each...

Incorrect Implementation of Authentication Algorithm

Overview Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm due to lossy ISO-8859-1 encoding in the digest hash computation. An attacker can log in as a user with a non-Latin-1 password by supplying a collision password that replaces each...

Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

Summary The DigestAuthentication.apply method in Jetty's HTTP client uses getBytesStandardCharsets.ISO88591 at three locations lines 171, 179, 196 to compute Digest auth response hashes. ISO-8859-1 silently replaces any character above U+00FF Chinese, Japanese, Cyrillic, Arabic, Emoji, etc. with...

Incorrect Implementation of Authentication Algorithm

Overview Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm due to lossy ISO-8859-1 encoding in the digest hash computation. An attacker can log in as a user with a non-Latin-1 password by supplying a collision password that replaces each...

GHSA-2FVJ-HGJ9-J2GR Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

Summary The DigestAuthentication.apply method in Jetty's HTTP client uses getBytesStandardCharsets.ISO88591 at three locations lines 171, 179, 196 to compute Digest auth response hashes. ISO-8859-1 silently replaces any character above U+00FF Chinese, Japanese, Cyrillic, Arabic, Emoji, etc. with...

USN-8589-1 apache2 vulnerabilities

It was discovered that Apache HTTP Server's modldap module incorrectly handled memory when processing per-directory configurations. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-29167 It was discovered that Apache HTTP Server's...

USN-8589-1: Apache HTTP Server vulnerabilities

It was discovered that Apache HTTP Server's modldap module incorrectly handled memory when processing per-directory configurations. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-29167 It was discovered that Apache HTTP Server's...

squid: Fix of 2 CVEs

CVE-2026-47729: fix out-of-bounds read in the FTP directory listing parser ftpListParseParts by stopping the whitespace skip at the end of the input buffer - CVE-2026-50012: fix heap buffer overflow in peerDigestSwapInMask by rejecting cache digest replies whose mask data exceeds the declared...

tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication

A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls...

tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication

A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls...

RLSA-2026:41906 Important: httpd security, bug fix, and enhancement update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: incomplete fix for CVE-2023-38709 CVE-2024-42516 Apache HTTP Server: modrewrite: Apache HTTP Server: Privilege Escalation via .htaccess file manipulation CVE-2026-24072 http...

PT-2026-63532

Name of the Vulnerable Software and Affected Versions Eclipse Jetty affected versions not specified Description The Digest authentication server-side component and the DigestAuthentication.apply method in the HTTP client use ISO-8859-1 encoding to process passwords. Because ISO-8859-1 cannot...

SUSE-SU-2026:22889-1 Security update for curl

This update for curl fixes the following issues - CVE-2026-8286: wrong STARTTLS connection reuse bsc1268402. - CVE-2026-8458: wrong reuse for different services bsc1268407. - CVE-2026-8924: traling dot domain super cookie bsc1268409. - CVE-2026-8927: env-set cross-proxy Digest auth state leak...

AlmaLinux 9 : httpd (ALSA-2026:41906)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:41906 advisory. httpd: incomplete fix for CVE-2023-38709 CVE-2024-42516 Apache HTTP Server: modrewrite: Apache HTTP Server: Privilege Escalation via .htaccess file...

SUSE-SU-2026:22801-1 Security update for python-cryptography

This update for python-cryptography fixes the following issues - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270208. - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-...