Security Bulletin: Multiple vulnerabilities in IBM Aspera HTTP Gateway

Summary Multiple vulnerabilities were addressed in IBM Aspera HTTP Gateway version 2.3.5 Vulnerability Details ID:WS-2026-0043 DESCRIPTION: Denial of service via exponential $ref expansion in ExpandSpec/ExpandSchema in github.com/go-openapi/spec. The expander inlines every $ref without memoizatio...

CVE-2026-104636

Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations followed HTTP redirects without revalidating the destination. A repository administrator using a policy-allowed endpoint that redirects...

CVE-2026-102168

On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the service automatically restarts. Remot...

CVE-2026-102169

On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low-rate attack can cause a persistent...

CVE-2026-105800

A flaw was found in i18next-http-backend. A remote attacker can supply crafted language or namespace values to applications configured with custom translation path templates that begin directly with placeholders. This manipulation causes the application to generate unintended external web...

h2spacex

H2SpaceX Libreria HTTP/2 di basso livello basata su Scapy che può essere utilizzata per il Single Packet Attack Race Condition su H2 Questa libreria è stata parte di una ricerca accademica dal titolo QUIC-er Races: HTTP/3 won’t save you from TOCTOU vulnerabilities. Approfondimento sull'articolo...

Apache Tomcat - Remote Code Execution

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled e.g. via setting the readonly initialisation parameter of the Default servlet to false it was possible to upload a JSP file to the server via a specially crafted...

CVE-2026-102169 Security Advisory 0194

On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low-rate attack can cause a persistent...

CVE-2026-102169

Affected Arista Wi-Fi access points with Captive Portal enabled are vulnerable to a denial of service (DoS) condition. An unauthenticated wireless client can crash the portal service by sending a crafted HTTP request to a captive-portal-enabled SSID. While the service automatically restarts, a su...

EUVD-2026-93964

On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low-rate attack can cause a persistent...

CVE-2026-102168 Security Advisory 0194

On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the service automatically restarts. Remot...

EUVD-2026-93963

On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the service automatically restarts. Remot...

CVE-2026-102169 Security Advisory 0194

On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low-rate attack can cause a persistent...

CVE-2026-102168 Security Advisory 0194

On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the service automatically restarts. Remot...

CVE-2026-102168

Affected Arista Wi-Fi access points with Captive Portal enabled are vulnerable to a service crash. An unauthenticated wireless client connected to a Captive-Portal-enabled SSID can send a crafted HTTP request to crash the portal service. This vulnerability, caused by an Integer Underflow (CWE-191...

CVE-2026-104636 Gitea SSRF through Git HTTP redirects in mirrors and fetches

Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations followed HTTP redirects without revalidating the destination. A repository administrator using a policy-allowed endpoint that redirects...

CVE-2026-104636

Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations followed HTTP redirects without revalidating the destination. A repository administrator using a policy-allowed endpoint that redirects...

EUVD-2026-93916

Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations followed HTTP redirects without revalidating the destination. A repository administrator using a policy-allowed endpoint that redirects...

CVE-2026-104636 Gitea SSRF through Git HTTP redirects in mirrors and fetches

Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations followed HTTP redirects without revalidating the destination. A repository administrator using a policy-allowed endpoint that redirects...

CVE-2026-104636 Gitea SSRF through Git HTTP redirects in mirrors and fetches

Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations followed HTTP redirects without revalidating the destination. A repository administrator using a policy-allowed endpoint that redirects...