K000163653: Apache HTTP Server vulnerabilities CVE-2026-56449 and CVE-2026-57941

Security Advisory Description CVE-2026-56449 Out-of-bounds Write vulnerability in Apache HTTP Server's modproxyhtml with crafted HTTP response bodies. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. CVE-2026-57941 Use After Free vulnerability in Apache HTTP Server's modhttp2 via...

PT-2026-110586

LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches xml-stylesheet href URLs without scheme or host allowlisting. Authenticated users can upload XML documents whose stylesheet href points to internal http,...

Medium: perl-HTTP-Date

Issue Overview: parsedate -- and str2time, which delegates to it -- used regexes with ambiguous adjacent greedy runs year/clock/timezone digits and timezone/ASCII-timezone letters before a trailing anchor. A valid-looking date prefix followed by a long interior run of digits, letters, or whitespa...

PT-2026-111122

Name of the Vulnerable Software and Affected Versions IBM i version 7.3 IBM i version 7.4 IBM i version 7.5 IBM i version 7.6 Description Improper data sanitization within the HTTP Server Administration web application allows a remote authenticated attacker to execute arbitrary code or obtain...

PT-2026-110954

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.4.1 Description The GenerateShortToken function creates standalone short-token records that lack a long Token value. However, the DeleteUserTokens function only invalidates cached entries when the long Token field ...

PT-2026-110885

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header...

PT-2026-110742

Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, a...

PT-2026-110777

Name of the Vulnerable Software and Affected Versions MONAI versions 0.4.0 through 1.6.0 Description An issue exists where on-path attackers can achieve remote code execution by tampering with SENet pretrained weights fetched over plaintext HTTP. This occurs when the load state dict from url...

Medium: perl-HTTP-Tiny

Issue Overview: HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, mayberedirect follows the Location: header and prepareheadersandcb re-merges the caller's headers argument into the new request, without...

Fixed in Apache Tomcat 10.1.61

Important: HTTP/2 request/response mix-up after error during async processing CVE-2026-101356 Incorrect object recycling and re-use affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This was fixed with commit 6c7da608. This issue was...

Fixed in Apache Tomcat 11.0.27

Important: AJP response mix-up CVE-2026-103119 A buffer under-read meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly...

CVE-2026-109575: Missing Authentication for Critical Function

In HAProxy Data Plane API 2.2.0 through 3.4.3 and corresponding Enterprise Edition releases, Server.ConfigureAPI has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority tlsca is configured and a numeric TLS...

Fixed in Apache Tomcat 9.0.123

Important: HTTP/2 request/response mix-up after error during async processing CVE-2026-101356 Incorrect object recycling and re-use affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This was fixed with commit 4b1eb9a1. This issue was...

PT-2026-110982

Name of the Vulnerable Software and Affected Versions Edimax BR-6208AC version 1.32 Description A security flaw exists in the HTTP Blocking Page component. A remote attacker can perform a manipulation of the /goform/formUrlb endpoint to execute cross site scripting, which is a technique used to...

PT-2026-110862

Name of the Vulnerable Software and Affected Versions obsidian-tc versions prior to 1.3.1 Description The Streamable HTTP transport fails to validate the Host or Origin header and lacks DNS-rebinding protection. DNS-rebinding is a technique used to bypass the Same-Origin Policy, allowing a websit...

CVE-2026-77363: Origin Validation Error

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration uses auth.mode set to none, a maliciou...

PT-2026-120386

Уязвимость функции freerdp http request RDP-клиента FreeRDP связана с ошибками процедуры подтверждения подлинности сертификата. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, подменить RDP-сервер...

Medium: perl-HTTP-Date

Issue Overview: parsedate -- and str2time, which delegates to it -- used regexes with ambiguous adjacent greedy runs year/clock/timezone digits and timezone/ASCII-timezone letters before a trailing anchor. A valid-looking date prefix followed by a long interior run of digits, letters, or whitespa...

Amazon Linux 2 : perl-HTTP-Date (ALAS-2026-3996)

The version of perl-HTTP-Date installed on the remote host is prior to 6.02-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3996 advisory. parsedate -- and str2time, which delegates to it -- used regexes withambiguous adjacent greedy runs year/clock/timezone digit...

Amazon Linux 2023 : perl-HTTP-Date, perl-HTTP-Date-tests (ALAS2023-2026-3210)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3210 advisory. parsedate -- and str2time, which delegates to it -- used regexes withambiguous adjacent greedy runs year/clock/timezone digits andtimezone/ASCII-timezone letters before a trailing anchor. A valid-...