638 matches found
Veeam Software Appliance Fails to Boot with Kernel Panic on AMD EPYC Hosts
Challenge A Veeam Software Appliance Linux-based Veeam Backup & Replication virtual machine running on a host with an AMD EPYC processor intermittently fails to boot after a reboot, including a reboot that follows an update that installs a new kernel. The following kernel panic occurs during earl...
CLEANSTART-2026-WF82140 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments
CVE-2026-59969 affects multiple packages. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. See references for individual vulnerability details...
Medium: libreswan
Issue Overview: In Libreswan before 5.3.2, when the operating system and Libreswan are running in FIPS mode and at least one CA certificate is loaded, a malformed X.509 certificate payload can cause the pluto daemon to abort on an assertion. In FIPS mode, adddecodedcert calls CERTExtractPublicKey...
BIT-TOMCAT-2026-74048 Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up
Not Failing Securely 'Failing Open' vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from...
golang-fips: Golang FIPS zeroed buffer
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...
PT-2026-132485
Not Failing Securely 'Failing Open' vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from...
SUSE CVE-2026-77205
Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The...
libreswan: Denial of Service via sending bogus X.509 certificates
A flaw was found in Libreswan's handling of malformed X.509 certificates when running in FIPS mode. A remote attacker may cause a rejected certificate to remain in the NSS certificate cache, resulting in legitimate certificates with the same serial number being rejected. This can prevent affected...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Unchecked Return Value in Libreswan (CVE-2026-14957)
Summary IBM Watson Speech Services Cartridge is vulnerable to an Unchecked Return Value in Libreswan that can result in a denial of service condition in FIPS mode. Libreswan is used in our Speech Service runtimes This vulnerability has been addressed. Please read the details for remediation below...
SUSE CVE-2026-74048
Not Failing Securely 'Failing Open' vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from...
Linux Distros Unpatched Vulnerability : CVE-2026-74048
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Not Failing Securely 'Failing Open' vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails,...
Linux Distros Unpatched Vulnerability : CVE-2026-77205
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real...
CVE-2026-74048
A flaw was found in Apache Tomcat. When the server is configured to enforce FIPS Federal Information Processing Standards mode, a failure during FIPS activation causes Tomcat to log an error and continue running with standard non-FIPS cryptographic providers instead of terminating securely. This...
Not Failing Securely ('Failing Open')
Overview org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Not Failing Securely 'Failing Open' due to the OpenSSLLifecycleListener process. An attacker can cause the application to operate in...
DEBIAN-CVE-2026-74048
Not Failing Securely 'Failing Open' vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from...
CVE-2026-74048
Not Failing Securely 'Failing Open' vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from...
CVE-2026-74048 Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up
Not Failing Securely 'Failing Open' vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from...
EUVD-2026-105004
Not Failing Securely 'Failing Open' vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from...
CVE-2026-74048 Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up
Not Failing Securely 'Failing Open' vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from...
CVE-2026-74048
Not Failing Securely 'Failing Open' vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from...