Security Bulletin: Multiple vulnerabilities affects IBM Db2 Big SQL on IBM Software Hub

Summary Multiple vulnerabilities affects IBM Db2 Big SQL on IBM Software Hub 5.4 and earlier. Vulnerability Details CVEID:CVE-2026-53655 DESCRIPTION: node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar node-tar applies a PAX extended header's size= record and other PAX overrides to...

HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

SummaryHTTPX2 serializes the per-file Content-Type and custom headers supplied through the files= tuple API directly into the multipart/form-data body without validating custom header names or values. An attacker who can influence upload metadata passed to HTTPX2 can use CR or LF characters to...

HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

SummaryHTTPX2 can automatically add a Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. The resulting HTTP/1.1 request contains both framing headers, which can create an ambiguous message boundary and enable request smuggling or connection...

PYSEC-2026-3848 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

Summary HTTPX2 serializes the per-file Content-Type and custom headers supplied through the files= tuple API directly into the multipart/form-data body without validating custom header names or values. An attacker who can influence upload metadata passed to HTTPX2 can use CR or LF characters to...

PYSEC-2026-3849 HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

Summary HTTPX2 can automatically add a Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. The resulting HTTP/1.1 request contains both framing headers, which can create an ambiguous message boundary and enable request smuggling or connection...

PYSEC-2026-3943 WebOb: Open redirect in Location header normalization via leading C0 control / space characters

Summary This is a third follow-up to CVE-2024-42353 / GHSA-mg3v-6m49-jhp3 and CVE-2026-44889 / GHSA-fh3h-vg37-cc95. WebOb makes the Location header absolute when it serves a redirect. To stop a relative or protocol-relative target from redirecting users off-host, it checks the value for a URI...

WebOb: Open redirect in Location header normalization via leading C0 control / space characters

SummaryThis is a third follow-up to CVE-2024-42353 / GHSA-mg3v-6m49-jhp3and CVE-2026-44889 / GHSA-fh3h-vg37-cc95.WebOb makes the Location header absolute when it serves a redirect. To stop arelative or protocol-relative target from redirecting users off-host, it checksthe value for a URI scheme a...

PYSEC-2026-3832 eml_parser vulnerable to DoS via deeply nested parens in Received headers

Summary emlparser strips parenthesised CFWS comments from Received: headers using a regex-based fix-point loop. The loop has quadratic time complexity in the number of nested parens. A single Received: header containing 5,000 nested parens causes 1.3 seconds of CPU saturation per parsed message;...

PYSEC-2026-3811 Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access

Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...

kernel: netfilter: nf_log: validate MAC header was set before dumping it

A flaw was found in the Linux kernel's netfilter logging component. This vulnerability occurs because the system does not properly check if a network packet's Media Access Control MAC header is valid before attempting to log it. A local attacker could send a specially crafted network packet,...

kernel: netfilter: nf_log: validate MAC header was set before dumping it

A flaw was found in the Linux kernel's netfilter logging component. This vulnerability occurs because the system does not properly check if a network packet's Media Access Control MAC header is valid before attempting to log it. A local attacker could send a specially crafted network packet,...

kernel: net: pull headers in qdisc_pkt_len_segs_init()

A flaw was found in the Linux kernel's handling of Generic Segmentation Offload GSO packet headers. This vulnerability occurs when the qdiscpktlensegsinit function does not properly pull headers into the expected memory location, which can lead to incorrect processing by network drivers. A remote...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending oversized or invalid baggage headers. The Parse function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when...

SUSE CVE-2026-86205

h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack utility that fails to sanitize protocol-relative paths in the Referer header pathname. Attackers can craft a same-origin URL with a double-slash path segment that passes origin validation but produces a...

Exploit for Improper Handling of Case Sensitivity in Apache Camel

CVE-2025-27636 – Apache Camel RCE Simple Python exploit for t...

PT-2026-89696

Summary When backend/local is used with --links/-l or the links=true config option, each symlink is exposed as an rclone object whose content is the target path string, suffixed .rclonelink. Object.Open decodes an incoming fs.RangeOption via Decodeo.Size, then for a translated-symlink object pass...

PT-2026-89359

ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the read ID3 Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size...

PT-2026-89474

Name of the Vulnerable Software and Affected Versions rclone versions 1.49.0 through 1.75.0 Description The HTTP backend in rclone fails to implement a specific http.Client.CheckRedirect policy when using the fshttp.NewClient client in backend/http/http.go. This causes the application to follow t...

PT-2026-89683

Vulnerability Details File: backend/http/http.go Lines: 285 client construction — no CheckRedirect, 505-510 addHeaders, writes configured secret headers onto every request, 533-534 / 700-701 / 782-785 f.httpClient.Doreq used by List/stat/download Root Cause The http backend lets a user attach...