Netty: TOCTOU in OcspServerCertificateValidator

Summary Netty's OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client's downstream handlers to send sensitive application data e.g., HTTP requests to a revoked server before the channel is closed by the OC...

GHSA-WC96-39FC-566F Netty: TOCTOU in OcspServerCertificateValidator

Summary Netty's OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client's downstream handlers to send sensitive application data e.g., HTTP requests to a revoked server before the channel is closed by the OC...

CVE-2026-13070

A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a...

CVE-2026-13070

The CVE affects MongoDB servers performing outbound TLS connections. A malformed OCSP response during the TLS handshake can cause the server to terminate abnormally, due to OCSP stapling validation enabled by default for outgoing connections. Impact is primarily availability (possible process ter...

EUVD-2026-47791

A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a...

Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination

A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a...

CVE-2026-13070 Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination

A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a...

unbound: Unbound: Denial of Service due to freed pointer dereference in DNS-over-TLS handling

A use-after-free flaw was found in Unbound's DNS-over-TLS DoT forwarded query handling. A remote attacker can exploit a timing error during TLS handshake failures on a server under load to trigger a daemon crash, resulting in a Denial of Service DoS...

CVE-2026-50046 Possible heap use-after-free in an error path when a DoT forwarded query is jostled out

In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS DoT forwarded queries is tied to a struct's 'servicedquery' lifetime but also referenced by another struct 'waitingtcp'. When the owning struct is jostled out of the mesh while the DoT TCP stream is...

CVE-2026-50046

In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS DoT forwarded queries is tied to a struct's 'servicedquery' lifetime but also referenced by another struct 'waitingtcp'. When the owning struct is jostled out of the mesh while the DoT TCP stream is...

EUVD-2026-47672

In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS DoT forwarded queries is tied to a struct's 'servicedquery' lifetime but also referenced by another struct 'waitingtcp'. When the owning struct is jostled out of the mesh while the DoT TCP stream is...

PT-2026-63545

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description The OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous Online Certificate Status Protocol OCSP validation...

openSUSE 16: gstreamer-plugins-bad / gstreamer-plugins-bad-chromaprint / etc (openSUSE-SU-2026:21370-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21370-1 advisory. This update for gstreamer-plugins-bad fixes the following issues - CVE-2026-12891: unchecked aspectratioidc value used as an array index in the...

ALSA-2026:42887 Important: java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fixes: JDK: Enhance TLS certificate handling CVE-2026-46968 JDK: Improve DTLS handshaking CVE-2026-46917 JDK: Enhance JPEG handling CVE-2026-47010 JDK: Enhance X...

CVE-2026-63979

A flaw was found in the Linux kernel's net/handshake component. A race condition exists where a network handshake request can be removed and its associated file reference released concurrently while the accept-side code attempts to access it. This can lead to the system attempting to read from...

CVE-2026-63980

A flaw was found in the Linux kernel's network handshake component. An improper locking mechanism, specifically the use of spinlock instead of spinlockbh in the handshakereqcancel function, can lead to a deadlock. This vulnerability occurs when a process-context thread holds a lock while a softir...

CVE-2026-63978

A flaw was found in the Linux kernel's network handshake component. When a network namespace exits, pending handshake requests may not be properly released due to incorrect list handling. This can lead to resource leaks and a list-corruption race, potentially resulting in memory corruption. An...

SUSE CVE-2026-63978

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending requests at net namespace exit The arguments to listspliceinit in handshakenetexit are reversed. The call moves the local empty "requests" list onto hn-hnrequests, leaving the local list empty, so the...

SUSE CVE-2026-63979

In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to acceptdoit handshakereqnext removes the request from the per-net pending list and drops hnlock before handshakenlacceptdoit reads req-hrsk-sksocket and dereferences sock-file...

SUSE CVE-2026-63980

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spinlockbh for hnlock nvmettcpstatechange, a socket callback that runs in BH context, can reach handshakereqcancel via nvmettcpschedulereleasequeue and tlshandshakecancel. handshakereqcancel acquires hn-hnlock...