CVE-2026-18717 Improper Certificate Validation in ASE 2000

ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications...

curl: 53: HTTP/1 CONNECT chunked-407 trailers bypass CURLOPT_SUPPRESS_CONNECT_HEADERS and lose CURLH_CONNECT classification

Summary When an HTTP/1 proxy returns a chunked 407 Proxy Authentication Required during a CONNECT handshake, any trailer fields in that response are delivered to the header callback even when CURLOPTSUPPRESSCONNECTHEADERS is enabled, and are classified as CURLHTRAILER instead of CURLHCONNECT in t...

BIT-NEO4J-ENTERPRISE-2026-14587 Unathenticated connection can hold Bolt channel open

Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for mo...

PT-2026-82756

ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications...

CVE-2026-47848

In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 -...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

SUSE-SU-2026:3815-1 Security update for go1.25-openssl

This update for go1.25-openssl fixes the following issues: Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips. Security issues fixed: - CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures c...

SUSE CVE-2026-74270

In the Linux kernel, the following vulnerability has been resolved: handshake: Require admin permission for DONE command ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted handshake agent tlshd. ACCEPT already requires GENLADMINPERM; DONE has ...

CVE-2026-47848: Undefined Security Weakness

In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 -...

USN-8678-2: OpenSSL, OpenSSL 1.0 vulnerabilities

USN-8678-1 fixed vulnerabilities in OpenSSL. This update provides the corresponding fix for OpenSSL and OpenSSL 1.0 on Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. In addition, this update also fixes the following issues that were not previously addressed in those releases: It was...

CVE-2026-54874

A flaw was found in OpenSSL. Receiving a DTLS Datagram Transport Layer Security record for a future epoch while a handshake is in progress causes OpenSSL to buffer an excessive amount of memory. This allows a peer to cause memory exhaustion, eventually resulting in a denial of service, using a...

Asymmetric Resource Consumption (Amplification)

Overview Affected versions of this package are vulnerable to Asymmetric Resource Consumption Amplification in dtlsrlayerbufferrecord in ssl/record/methods/dtlsmeth.c. An attacker can cause a DTLS endpoint to retain excessive memory by sending a stream of small next-epoch records during an...

CVE-2026-54874

Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large...

CVE-2026-59646

A flaw was found in Bouncy Castle for Java. The DTLS Datagram Transport Layer Security handshake reassembler allocates buffers based on an unchecked 24-bit length value. A remote attacker could exploit this vulnerability by sending a specially crafted DTLS handshake message, leading to excessive...

Linux Distros Unpatched Vulnerability : CVE-2026-54874

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself...

TencentOS Server 4: etcd (TSSA-2026:0852)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0852 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

PT-2026-81301

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.0.2 through 4.0 Description Receiving a DTLS record for a future epoch during a handshake causes the system to buffer significantly more memory than the record requires. This occurs because the software retains the entire re...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: The return value of nvmettcpsetqueuesock is currently ignored in nvmettcptlshandshakedone. If this function fails e.g., because the socket is not in the TCPESTABLISHED state, the socket callbacks will not be properly...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: The pin mechanism for the upper rpcclnt across the TLS-connected connectworker. The TLS connection process involves a use-after-free: Nothing pinning the upper rpcclnt occurs during the delayed connectworker. The xsconnec...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: sunrpc: When canceling a TLS handshake that is still in progress, there is a race condition where the callback for the ongoing handshake is not properly handled. When waitforcompletioninterruptibletimeout in svctcphandshake retur...