Security update for cadvisor (important)

openSUSE security update: security update for cadvisor ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22218-1 Rating: important References: bsc1288212 bsc1288588 Cross-References: CVE-2026-116591 CVE-2026-78663 CVSS scores: CVE-2026-116591 SUSE : 7...

USN-8972-1: HAProxy vulnerabilities

It was discovered that HAProxy incorrectly handled truncated HTTP/2 PING frames. A remote attacker could possibly use this issue to cause HAProxy to consume excessive CPU resources, leading to a denial of service. CVE-2026-110353 It was discovered that HAProxy incorrectly handled certain HTTP/1.1...

USN-8972-1 haproxy vulnerabilities

It was discovered that HAProxy incorrectly handled truncated HTTP/2 PING frames. A remote attacker could possibly use this issue to cause HAProxy to consume excessive CPU resources, leading to a denial of service. CVE-2026-110353 It was discovered that HAProxy incorrectly handled certain HTTP/1.1...

tomcat: Apache Tomcat: HTTP/2 request smuggling due to header mix-up

A flaw was found in Apache Tomcat. This vulnerability, identified as HTTP Request/Response smuggling, stems from an inconsistent interpretation of HTTP/2 requests. A regression in a prior security fix can cause request headers to be mixed up. This could allow a remote attacker to bypass security...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.3 release and security update

Red Hat JBoss Web Server 7.0.3 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives ...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.3 release and security update

Red Hat JBoss Web Server 7.0.3 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Windows Server. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...

tomcat: Apache Tomcat: HTTP/2 request smuggling due to header mix-up

A flaw was found in Apache Tomcat. This vulnerability, identified as HTTP Request/Response smuggling, stems from an inconsistent interpretation of HTTP/2 requests. A regression in a prior security fix can cause request headers to be mixed up. This could allow a remote attacker to bypass security...

RLSA-2026:93469 Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65182 tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve N...

Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issues: CVE-2026-78659: golang.org/x/net/http2: HTTP/2 server memory exhaustion due to Trailer headers bsc1286994. CVE-2026-78660: golang.org/x/net/http2: HTTP/2 transport accepts malformed framing-related headers bsc1287058...

Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Predict Component uses IBM WebSphere Application Server Liberty , gnupg2 2.2.20-3.el86, platform-python 3.9.20-1.module+el8.10.0+22342+478c159e, platform-python 50.3.2-6.module+el8.10.0+22183+c898c0c1 , libarchive 3.5.3-9.el97 , platform-python...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.41 security and extras update

Red Hat OpenShift Container Platform release 4.21.41 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a security impact of...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.21 security and extras update

Red Hat OpenShift Container Platform release 4.22.21 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a security impact of...

CLEANSTART-2026-NH23437 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

Security vulnerability affects the rabbitmq-cluster-operator package. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing...

CLEANSTART-2026-UR29764 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

Security vulnerability affects the rabbitmq-cluster-operator package. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

CLEANSTART-2026-XV44707 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

Security vulnerability affects the rabbitmq-cluster-operator package. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the...

SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:4954-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4954-1 advisory. - CVE-2026-8932: incomplete mTLS config matching in conn reuse bsc1268414. - CVE-2026-11856: cross-origin Dige...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

CVE-2026-106806

A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeat...

Astra Linux – vulnerability in libsoup3, libsoup2.4

A vulnerability was found in libsoup’s HTTP/2 protocol implementation. Under certain stream termination conditions—such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets—the library fails to properly release memory context blocks. A remote, unauthenticated attack...

Astra Linux – vulnerability in libsoup3

A heap buffer over-read vulnerability was discovered in libsoup’s versions: libsoup 3.0 through 3.7.0 HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it mishandles the “Additional Debug Data” payload by treating the data stream as a safely NUL-terminated...