687 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-102560
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for...
GHSA-3WWX-PV8P-Q78V undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
Impact undici's WebSocket client including Node.js's bundled globalThis.WebSocket crashes the entire Node.js process when a remote WebSocket peer sends a permessage-deflate compressed message that crosses the decompressed-payload size limit and then contains a malformed DEFLATE block. In...
NPM: undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
NPM: undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression vulnerability discovered by ? in WordPress Npm undici versions = 6.25.0, 6.28.1...
EUVD-2026-71603
undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression...
undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
Impact undici's WebSocket client including Node.js's bundled globalThis.WebSocket crashes the entire Node.js process when a remote WebSocket peer sends a permessage-deflate compressed message that crosses the decompressed-payload size limit and then contains a malformed DEFLATE block. In...
CVE-2026-87022
A flaw was found in Apache Tomcat. This vulnerability, related to improper handling of length parameters, allows for WebSocket message smuggling when the 'per-message-deflate' extension is in use. A remote attacker could exploit this to bypass security controls or inject malicious data into...
CVE-2026-100658 Netty before 4.1.138.Final Denial of Service via WebSocketServerExtensionHandler
Netty io.netty:netty-codec-http contains an unbounded per-connection queue in WebSocketServerExtensionHandler. The handler offers an entry to its per-channel validExtensions queue for every inbound HttpRequest, but polls an entry only when the application writes an HttpResponse, and the queue siz...
CVE-2026-100658
The Netty component (io.netty:netty-codec-http ) is vulnerable to a denial-of-service (DoS) attack due to an unbounded per-connection queue in WebSocketServerExtensionHandler . An unauthenticated remote peer can use HTTP/1.1 pipelining to send requests faster than the application produces respons...
OESA-2026-4044 libsoup security update
libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: A flaw was found in libsoup's WebSocket implementation when using the...
OESA-2026-4008 libsoup3 security update
Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. Security Fixes: A flaw was found in libsoup's WebSocket implementation when using...
OESA-2026-4006 libsoup3 security update
Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. Security Fixes: A flaw was found in libsoup's WebSocket implementation when using...
SUSE CVE-2026-67232
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...
SUSE CVE-2026-87022
Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...
RHEL 10 : libsoup3 (RHSA-2026:71389)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71389 advisory. Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup,...
Linux Distros Unpatched Vulnerability : CVE-2026-87022
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This iss...
DEBIAN-CVE-2026-67232
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...
CVE-2026-67232
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...
AZL-105795 CVE-2026-67232 affecting package rabbitmq-server 3.13.7-9
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...
CVE-2026-67232
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...