OESA-2026-3782 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTT...

OESA-2026-3724 python-gunicorn security update

GunicornGreen Unicorn is a Python WSGI HTTP Server for UNIX. It's a pre-fork worker model ported from Ruby's Unicorn project. The Gunicorn server is broadly compatible with various web frameworks, simply implemented, light on server resource usage, and fairly speedy. Security Fixes: Gunicorn...

EUVD-2026-77627

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer allow internal/transport/http2server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go...

CVE-2026-84445

CVE-2026-84445 affects gRPC-Go prior to versions 1.82.2 and 1.83.2 . Servers created via xds.NewGRPCServer() accept RPCs containing neither the :authority nor Host header. The RouteAndProcess function in internal/xds/server/routing.go then assumes an authority value exists and indexes an empty sl...

Security Bulletin: IBM DataPower Gateway affected by authentication bypass due to follow-redirects (CVE-2026-40895)

Summary IBM DataPower Gateway has addressed CVE-2026-40895 in versions 11.0.0.2, 10.6.0.10, 10.5.0.22 Vulnerability Details CVEID:CVE-2026-40895 DESCRIPTION: follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. Prior to...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validating the command header size against SVGACMDMAXDATASIZE This data originates from user space and is used in buffer offset calculations, which may potentially lead to an out-of-bounds access if the calculation...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: bridge: xmit: Ensure that the ethheaderlen field is set to a valid value. The syzbot triggered an uninitvalue1 error in the bridgedevice’s xmit path by sending a packet shorter than ETHHLEN bytes. To fix this issue, check...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix incorrect page release Under the following conditions: 1 No skb has been created yet. 2 headersize == 0 no SHAMPO header. 3 headerindex + 1 % MLX5ESHAMPOWQHEADERPERPAGE == 0 this is the last page fragment o...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: geneve: Do not assume that the MAC header is set in genevexmitskb. We should not assume that the MAC header is present in the output path. Instead, use skbethhdr instead of ethhdr to fix this issue. sysbot reported the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: lapb: increase LAPBHEADERLEN It is unclear whether the net/lapb code is ready for 8021q. We can at least avoid crashes like the following: skbuff: skbunderpanic: text:ffffffff8aabe1f6 len:24 put:20 head:ffff88802824a400...

Astra Linux – Vulnerability in ffmpeg

A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2, specifically in the libavcodec/getbits.h file, during the process of writing .mov files. This vulnerability may lead to memory corruption and other potential issues...

Astra Linux – Vulnerability in libpcap

The sf-pcapng.c file in libpcap before version 1.9.1 does not properly validate the PHB header length before allocating memory...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: veth: Ensure that the eth header is in the linear part of the skb structure. After feeding a decapsulated packet to a veth device using actmirred, skbheadlen might be set to 0. However, vethxmit calls devforwardskb, which expects...

Astra Linux – Vulnerability in Ruby-Rack

There is a denial-of-service vulnerability in the header parsing component of Rack...

Astra Linux – Vulnerability in ffmpeg

FFmpeg 4.2 is affected by a divide-by-zero issue through the libavcodec/lpc.h library, which allows a remote malicious user to cause a Denial of Service attack...

Astra Linux – Vulnerability in Twisted

In Twisted Web version 19.10.0, there was an HTTP request splitting vulnerability. When two content-length headers were provided, the system ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Firmware: csdsp – Fixed the overflow checking of the wmfw header. The issue involved fixing the check to ensure that the firmware file buffer is large enough to accommodate the wmfw header, thereby preventing the buffer from bein...

Astra Linux – Vulnerability in Python-Django

In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of the Accept-Language header are cached in order to avoid repeated parsing. This can lead to a potential denial-of-service vulnerability due to excessive memory usage if the raw value of the Accept-Language...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: A potential out-of-bounds read vulnerability exists in processmessageheader. If the message frame is maliciously corrupted in such a way that the length of the control segment becomes shorter than the size of the message...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ARP: Do not assume that devhardheader does not change skb-head. arpcreate is the only function that calls devhardheader, and it makes the assumption that skb-head remains unchanged. A recent commit broke this assumption. The @arp...