CVE-2026-58160

Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue...

EUVD-2026-50213

Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue...

CVE-2026-58160 Apache Traffic Server: Out-of-bounds reads while parsing DNS responses

Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue...

CVE-2026-22068 Apache Traffic Server: Regex mappings match with malicious domain names

Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue...

SUSE-SU-2026:22977-1 Security update for samba

This update for samba fixes the following issues: - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server bsc1271672. - CVE-2026-15779: pamwinbind module with mkhomedir set allows chown of critical system paths without validation bsc1271469. - CVE-2026-58216: 6-by...

[slackware-security] samba

New samba packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: extra/samba-4.22.11-i586-1slack15.0.txz: Upgraded. This is a security release in order to address the following defects: TSIG packet with name compressi...

SUSE SLES15: ctdb / libsamba-policy-devel / libsamba-policy-python3-devel / etc (SUSE-SU-2026:3362-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3362-1 advisory. This update for samba fixes the following issues - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS...

PT-2026-65748

Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue...

F5 Networks BIG-IP : BIND vulnerability (K000162286)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.3 / 17.5.1.7 / 21.1.0. It is, therefore, affected by a vulnerability as referenced in the K000162286 advisory. If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolv...

Linux Distros Unpatched Vulnerability : CVE-2026-6949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - TSIG packet with crafted name compression can crash DNS server fedora-all CVE-2026-6949 Note that Nessus relies on the presence of the package as reported by th...

SUSE SLES12: ctdb / libsamba-policy-devel / libsamba-policy-python3-devel / etc (SUSE-SU-2026:3367-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3367-1 advisory. This update for samba fixes the following issues - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server...

CVE-2026-55391

CVE-2026-55391 affects the datamodel-code-generator project. Prior to version 0.63.0, the tool validates a URL host in http.py via get_body, _validate_url_for_fetch, and _get_ips_from_host, but then allows httpx to resolve the host again for the connection, enabling DNS rebinding to bypass allow_...

CVE-2026-55391 datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodelcodegenerator/http.py through...

firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: DNS component...

RLSA-2026:46394 Important: go-fdo-client security update

go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding. Security Fixes: crypto/x509: golang: golang crypto/x509: Denial of Service via excessive...

unbound security update

An update is available for unbound. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The unbound packages provide a validating, recursive, and caching DNS or...

CVE-2026-48487

A flaw was found in Zeroconf, a Python library for multicast DNS service discovery. An unauthenticated attacker on the local network can exploit a vulnerability in how the system processes incoming DNS records. By sending a specially crafted record with an excessive length, the attacker can cause...

firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: DNS component...

CVE-2026-41637

A flaw was found in Unbound, a Domain Name System DNS resolver. A remote attacker can exploit this vulnerability by sending and immediately terminating DNS-over-QUIC DoQ queries. This improper handling of terminated queries can lead to a build-up of pending responses, causing a degradation of...

CVE-2026-57211

A flaw was found in RabbitMQ. The RabbitMQ management plugin static file handler, rabbitmgmtwmstatic, on Windows can be exploited when multiple management extension plugins are enabled. An attacker can pass specially crafted URL-encoded backslashes, bypassing path validation. This can lead to...