CVE-2026-60005 vulnerabilities

Vulnerabilities for packages: nginx-mainline, nginx-stable...

UBUNTU-CVE-2026-59902

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with...

haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions

A flaw was found in HAProxy. An attacker can trigger HPACK dynamic table insertions under memory pressure, leading to a null pointer dereference in the hpackdhtinsert function. This can cause HAProxy worker processes to crash, resulting in a denial of service DoS...

SUSE-SU-2026:3630-1 Security update for kubevirt-1.6, virt-api-container-1.6, virt-controller-container-1.6, virt-exportproxy-container-1.6, virt-exportserver-container-1.6, virt-handler-container-1.6, virt-launcher-container-1.6, virt-libguestfs-tools-container-1.6, virt-operator-container-1.6, virt-pr-helper-container-1.6, virt-synchronization-controller-container-1.6

This update for kubevirt-1.6, virt-api-container-1.6, virt-controller-container-1.6, virt-exportproxy-container-1.6, virt-exportserver-container-1.6, virt-handler-container-1.6, virt-launcher-container-1.6, virt-libguestfs-tools-container-1.6, virt-operator-container-1.6,...

Security Bulletin: Multiple vulnerabilities in third-party Netty libraries affect the IBM Informix Wire Listener.

Summary Multiple vulnerabilities in Netty affect the IBM Informix Wire Listener. IBM Informix has addressed these vulnerabilities by updating the Netty components to their latest versions. Vulnerability Details CVEID:CVE-2026-33871 DESCRIPTION: Netty is an asynchronous, event-driven network...

BIT-NODE-MIN-2026-56848

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

BIT-NODE-MIN-2026-56846

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js 24.x and 22.x...

BIT-NODE-2026-56848

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

BIT-NODE-2026-56846

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js 24.x and 22.x...

PT-2026-73406

A flaw in Node.js HTTP/2 handling allows nghttp2 session mem send to be called re-entrantly while nghttp2 session mem recv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

Moderate: nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 HTTP/2 protocol in C. Security Fixes: nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 For more details about the security issues,...

PT-2026-73394

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js 24.x and 22.x...

PT-2026-73396

A flaw in Node.js HTTP/2 handling allows nghttp2 session mem send to be called re-entrantly while nghttp2 session mem recv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

ALSA-2026:55804 Moderate: nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 HTTP/2 protocol in C. Security Fixes: nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 For more details about the security issues,...

PT-2026-73404

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js 24.x and 22.x...

MiracleLinux 9 : dotnet8.0-8.0.129-1.el9_8.ML.1 (AXSA:2026-1546:15)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1546:15 advisory. dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM CVE-2026-50651 dotnet: .NET Core: Denial of Service via type...

SUSE SLES16 Security Update : nodejs22 (SUSE-SU-2026:23130-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23130-1 advisory. Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF a...

SUSE SLES16 Security Update : nodejs24 (SUSE-SU-2026:23131-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23131-1 advisory. Update to 24.18.1. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF a...

SUSE CVE-2026-56853

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this...

CVE-2026-56853

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...