Important: libsoup3

Issue Overview: The fix for CVE-2026-0716 commit 6ff7ef0, libsoup 3.6.6 placed the integer overflow guard inside the if masked block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64MAX to trigge...

PT-2026-109073

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy ssl context, proxy assert hostname, proxy assert fingerprint, ssl context, cert reqs, verify mode, use forwarding for https=True, and CERT NONE configuration paths fail to remain separated because target-server TLS...

PT-2026-109113

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy ssl context, proxy assert hostname, proxy assert fingerprint, ssl context, cert reqs, verify mode, use forwarding for https=True, and CERT NONE configuration paths fail to remain separated because target-server TLS...

RHCOS 4 : Red Hat build of MicroShift 4.22.16 (RHSA-2026:71672)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71672 advisory. - encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 - net/http: golang...

PT-2026-108592

Security vulnerability affects the elasticsearch package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...

PT-2026-102596

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 153.4 Thunderbird versions prior to 157 Description A spoofing issue exists within the Networking: HTTP component. Recommendations Update Firefox to version 157. Update Firefox ESR to...

PT-2026-102521

A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service DoS and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/do cmd.js’ endpoint containing an excessively long...

PT-2026-102719

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transport socket options while selecting an HTTP/3 connection pool without first checking whether t...

PT-2026-102720

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the...

PT-2026-108401

Security vulnerability affects the langfuse package. undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1...

PT-2026-108433

Security vulnerability affects the argo-workflows package. Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution HPP...

PT-2026-108378

Security vulnerability affects the argo-workflows package. The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines...

CVE-2026-7192: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service DoS and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/docmd.js’ endpoint containing an excessively long...

PT-2026-108423

Security vulnerability affects the kafka package. A client may issue specially crafted HTTP/1...

PT-2026-102728

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes a...

PT-2026-102726

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete...

Amazon Linux 2023 : squid (ALAS2023-2026-3145)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3145 advisory. Due to a CWE-841 Improper Enforcement of Behavioral Workflowbug Squid is vulnerable to a Request Smuggling attack againstHTTP/1.1 Transfer-Encoding. This problem allows a trusted client to perform an...

Debian dla-4800 : glance - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4800 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4800-1 [email protected]...

Amazon Linux 2 : squid (ALAS-2026-3961)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3961 advisory. Due to a CWE-841 Improper Enforcement of Behavioral Workflowbug Squid is vulnerable to a Request Smuggling attack againstHTTP/1.1...

RHEL 8 : Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP6 (RHSA-2026:73076)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73076 advisory. Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP...