Security update for curl

This update for curl fixes the following issues: CVE-2026-8932: incomplete mTLS config matching in conn reuse bsc1268414. CVE-2026-11856: cross-origin Digest auth state leak bsc1268426. CVE-2026-12064: proto-default skips SSH verification bsc1268427. CVE-2026-19931: Negotiate ambient user conn...

CVE-2017-6640-POC

CVE-2017-6640-POC Proof of concept for CVE-2017-6640 as burp extension Cisco Prime Data Center Network Manager DCNM implements a static credentials. See also: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-dcnm2 More specifically, the Web UI requires users...

Oracle Linux 8 : curl (ELSA-2026-92368)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-92368 advisory. - fix incomplete mTLS config in connection reuse CVE-2026-8932 - fix cookie injection via trailing dot super cookies CVE-2026-8924 - fix digest auth...

curl security, bug fix, and enhancement update

7.61.1-34.el810.18 - fix incomplete mTLS config in connection reuse CVE-2026-8932 7.61.1-34.el810.17 - fix cookie injection via trailing dot super cookies CVE-2026-8924 - fix digest auth state leak on origin or credential change CVE-2026-11856 7.61.1-34.el810.16 - add sasl service name to...

EulerOS 2.0 SP11 : curl (EulerOS-SA-2026-4220)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS...

EulerOS 2.0 SP11 : curl (EulerOS-SA-2026-4311)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS...

curl security update

7.76.1-40.el98.8 - fix cookie injection via trailing dot super cookies CVE-2026-8924 - fix digest auth state leak on origin or credential change CVE-2026-11856...

curl security update

8.12.1-4.6 - fix cookie injection via trailing dot super cookies CVE-2026-8924 - fix digest auth state leak on origin or credential change CVE-2026-11856 - fix netrc password lookup for non-matching login CVE-2026-8926 8.12.1-4.5 - fix proxy auth not cleared properly on NULL CVE-2026-9079 - fix...

Oracle Linux 10 : curl (ELSA-2026-69125)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69125 advisory. - fix cookie injection via trailing dot super cookies CVE-2026-8924 - fix digest auth state leak on origin or credential change CVE-2026-11856 - fix...

EulerOS 2.0 SP10 : curl (EulerOS-SA-2026-3734)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS...

EulerOS 2.0 SP10 : curl (EulerOS-SA-2026-3687)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS...

tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication

A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls...

tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication

A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls...

tomcat security update

1:9.0.120-1 - Resolves: RHEL-192806 HTTP/2 request headers not validated CVE-2026-41293 - Resolves: RHEL-219561 Security constraint bypass via improper URL encoding in rewrite valve CVE-2026-59083 - Resolves: RHEL-219581 Insufficient documentation for EncryptInterceptor may lead to insecure...

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43512 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-41293...

CVE-2026-84439

An unauthenticated attacker can perform a log injection attack on Apache ZooKeeper (versions 3.9.0 through 3.9.5 and 3.8.0 through 3.8.6 ) when audit logging is enabled (zookeeper.audit.enable=true). By sending a digest authentication request containing tab characters ( ) in the username, an atta...

tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication

A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls...

gstreamer1-plugins-base: gstreamer: NULL/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted Digest Authorization/WWW-Authenticate header

A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length...

Security Bulletin: IBM SPSS Modeler is affected by an Eclipse Jetty vulnerability that may allow authentication bypass.

Summary IBM SPSS Modeler is affected by an Eclipse Jetty vulnerability that may allow authentication bypass. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-10050 DESCRIPTION: In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-...

OPENSUSE-SU-2026:21774-1 Security update for curl

This update for curl fixes the following issues: - CVE-2026-5773: wrong reuse of SMB connection bsc1262633. - CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. - CVE-2026-8926: password leak with netrc and user in URL bsc1268412. - CVE-2026-13608: OpenLDAP SASL authentication bypass...