DEBIAN-CVE-2026-82821

A vulnerability was determined in FLVMeta up to 1.2.2. Affected by this vulnerability is the function amfobjectget of the file src/amf.c of the component AMF Object Parsing. This manipulation causes null pointer dereference. The attack may be initiated remotely. The exploit has been publicly...

DEBIAN-CVE-2026-19953

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...

CVE-2026-19953

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...

UBUNTU-CVE-2026-19953

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...

CGA-4XVW-MR9F-PH52

Bulletin has no description...

CGA-6VH8-7WFQ-45H6

Bulletin has no description...

CGA-2RFF-W4CP-9363

Bulletin has no description...

CGA-32XF-X52P-28R6

Bulletin has no description...

CGA-2676-JR29-JFPX

Bulletin has no description...

CGA-7CMC-MMQV-F2WF

Bulletin has no description...

CGA-4P66-495R-75QP

Bulletin has no description...

CVE-2026-50572

A flaw was found in Envoy. In the external authorization extauthz HTTP client, completing an authorization request can send a rejection response and destroy the client while its completion handler is still executing. A remote attacker could exploit this timing condition to trigger a use-after-fre...

CVE-2026-48521

A flaw was found in Envoy. A remote attacker can cause a Denial of Service DoS when HTTP/3 and automatic protocol selection are enabled. The proxy attempts to access transport socket options during connection pool selection without verifying that they exist, causing an unexpected process crash wh...

CGA-FX3J-3554-2PH4

Bulletin has no description...

CVE-2026-73551

A flaw was found in Envoy. This vulnerability allows a remote attacker to bypass path-based access controls by sending requests with parameters inside dot and dot-dot URL path segments. Because Envoy fails to properly normalize these path segments, backend applications and access-control filters...

CVE-2026-73549

A flaw was found in Envoy. An attacker could cause a Denial of Service DoS by sending network requests using scoped Internet Protocol version 6 IPv6 client addresses. Due to improper parsing when copying network addresses in original destination routing configurations and HTTP/3 connections, the...

CVE-2026-73511

A flaw was found in Envoy. A remote attacker can exploit this vulnerability by submitting an HTTP request containing per-segment path parameters separated by semicolons. Due to differences in how Envoy and backend servers process these parameters, path matching rules can become misaligned,...

CVE-2026-73553

A flaw was found in Envoy. A remote, unauthenticated attacker can exploit this vulnerability to bypass access controls and reach protected backend endpoints. When path parameter stripping is enabled, Envoy strips parameters prior to routing requests but evaluates Role-Based Access Control RBAC...

CVE-2026-73550

A flaw was found in Envoy. An unauthenticated remote attacker can cause a Denial of Service DoS by exhausting system memory and crashing the proxy process. This vulnerability occurs because Envoy fails to count discarded duplicate Host header values against request header size and count limits...

CVE-2026-73552

A flaw was found in Envoy. When evaluating regular expressions in role-based access control RBAC policies, Envoy improperly treats non-UTF-8 characters in HTTP header values as non-matching input. A remote attacker can exploit this flaw by sending requests with specially crafted HTTP headers to...