CVE-2026-77776

Headroom LLM proxy (v0.29.0 and earlier) trusts the client-supplied x-headroom-user-id header as an authenticated identity without binding it to the caller. The header is read directly in headroom/proxy/handlers/openai.py across chat completion and websocket paths, allowing any client to imperson...

CVE-2026-77775 Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validation

Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. resolveopenaiupstreambase in headroom/proxy/handlers/openai.py accepts the header value, requires only that it parse with an http or https scheme and a hostname, and returns it for use ...

CVE-2026-77775

Headroom LLM proxy (headroomlabs-ai/headroom) is vulnerable to SSRF via the x-headroom-base-url request header. The functions _resolve_openai_upstream_base and _select_passthrough_base_url accept any URL with an http/https scheme and hostname without rejecting loopback, link-local, or RFC 1918 de...

EUVD-2026-63905

Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the value to the caller. A client can therefore name...

EUVD-2026-63904

Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. resolveopenaiupstreambase in headroom/proxy/handlers/openai.py accepts the header value, requires only that it parse with an http or https scheme and a hostname, and returns it for use ...

CVE-2026-72249

A flaw was found in the Linux kernel's netfilter flowtable. When processing the IP-in-IP IPIP header, the system incorrectly uses routing information from the opposite direction to calculate packet headroom and fragmentation flags. This can lead to incorrect packet handling and potentially affect...

Linux Distros Unpatched Vulnerability : CVE-2026-72249

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: flowtable: use dst in this direction when pushing IPIP header When pushing the IPIP header, the route of the other direction is used to calculate the...

CVE-2026-72319

In the Linux kernel, the following vulnerability has been resolved: ipvs: ensure inner headers in ICMP errors are in headroom Sashiko points out that after stripping the outer headers with pskbpull we should ensure the inner IP headers in ICMP errors from tunnels are present in the skb headroom f...

UBUNTU-CVE-2026-72319

In the Linux kernel, the following vulnerability has been resolved: ipvs: ensure inner headers in ICMP errors are in headroom Sashiko points out that after stripping the outer headers with pskbpull we should ensure the inner IP headers in ICMP errors from tunnels are present in the skb headroom f...

CVE-2026-72249

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: use dst in this direction when pushing IPIP header When pushing the IPIP header, the route of the other direction is used to calculate the headroom, use the route in this direction. Accessing the other tuple...

UBUNTU-CVE-2026-72249

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: use dst in this direction when pushing IPIP header When pushing the IPIP header, the route of the other direction is used to calculate the headroom, use the route in this direction. Accessing the other tuple...

EUVD-2026-59341

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix and simplify IP6IP6 tunnel handling Fix nfflowip6tunnelproto to use pskbmaypull instead of skbheaderpointer to ensure the outer IPv6 header is in the skb headroom, which is required for subsequent packet...

EUVD-2026-59218

In the Linux kernel, the following vulnerability has been resolved: ipvs: ensure inner headers in ICMP errors are in headroom Sashiko points out that after stripping the outer headers with pskbpull we should ensure the inner IP headers in ICMP errors from tunnels are present in the skb headroom f...

CVE-2026-72319 ipvs: ensure inner headers in ICMP errors are in headroom

In the Linux kernel, the following vulnerability has been resolved: ipvs: ensure inner headers in ICMP errors are in headroom Sashiko points out that after stripping the outer headers with pskbpull we should ensure the inner IP headers in ICMP errors from tunnels are present in the skb headroom f...

CVE-2026-72319

The CVE-2026-72319 entry describes a Linux kernel vulnerability in IPVS where inner IP headers in ICMP errors must be kept within skb headroom after removing outer headers (pskb_pull). The root cause involves ensuring the inner headers remain present for functions such as ipv4_update_pmtu(), icmp...

CVE-2026-72319 ipvs: ensure inner headers in ICMP errors are in headroom

In the Linux kernel, the following vulnerability has been resolved: ipvs: ensure inner headers in ICMP errors are in headroom Sashiko points out that after stripping the outer headers with pskbpull we should ensure the inner IP headers in ICMP errors from tunnels are present in the skb headroom f...

CVE-2026-72249 netfilter: flowtable: use dst in this direction when pushing IPIP header

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: use dst in this direction when pushing IPIP header When pushing the IPIP header, the route of the other direction is used to calculate the headroom, use the route in this direction. Accessing the other tuple...

CVE-2026-72249 netfilter: flowtable: use dst in this direction when pushing IPIP header

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: use dst in this direction when pushing IPIP header When pushing the IPIP header, the route of the other direction is used to calculate the headroom, use the route in this direction. Accessing the other tuple...

CVE-2026-72249

The CVE-2026-72249 entry documents a Linux kernel netfilter flowtable bug: when pushing IPIP headers, the code uses the wrong direction’s route to calculate headroom, causing iph->frag_off and headroom handling to be incorrect. The issue arises from accessing the other tuple to set IP source/d...

EUVD-2026-59148

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: use dst in this direction when pushing IPIP header When pushing the IPIP header, the route of the other direction is used to calculate the headroom, use the route in this direction. Accessing the other tuple...