Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by an uncontrolled resource consumption vulnerability due to Apache HttpComponents Core

Summary Apache HttpComponents Core is used by IBM Integrated Analytics System as a Java library providing low-level HTTP transport components. CVE-2026-54399 affects the HTTP/1.1 message parser in Apache HttpComponents Core versions 5.4.2 and earlier, where insufficient limits on the number and...

CVE-2026-77680 Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in...

Security Bulletin: Vulnerability in Axios affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Axios has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerability...

EulerOS Virtualization 2.13.0 : python3 (EulerOS-SA-2026-3235)

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : User-controlled header names and values containing newlines can allow injecting HTTP headers.CVE-2026-0865 Tenable has extracted t...

EulerOS Virtualization 2.13.1 : python3 (EulerOS-SA-2026-3195)

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : User-controlled header names and values containing newlines can allow injecting HTTP headers.CVE-2026-0865 Tenable has extracted t...

EulerOS Virtualization 2.13.1 : perl-HTTP-Tiny (EulerOS-SA-2026-3188)

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values.The...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation due to improper validation of HTTP headers in the headerFilterStrategy process. An attacker can manipulate HTTP headers to inject unauthorized directives or bypass intended header filtering by sending specially...

CVE-2026-71300 Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection

Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is...

JLSEC-2026-1381

Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The clcount and tecount checks in the mghttpparse and httpcb paths in src/http.c accept both...

SUSE CVE-2026-63379

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttpreadtrailer and merges them into request headers. The fix introduces evhttpparseheadersimpl and a temporary trailer header list. An unauthenticated remote...

go-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-For

...

[SECURITY] [DLA 4747-1] python-httplib2 security update

Debian LTS Advisory DLA-4747-1 [email protected] https://www.debian.org/lts/security/ Emmanuel Arias August 20, 2026 https://wiki.debian.org/LTS Package : python-httplib2 Version : 0.18.1-3+deb11u1 CVE ID : CVE-2021-21240 CVE-2026-59939 Debian Bug : 982738 Two vulnerabilities were...

AZL-97557 CVE-2026-63379 affecting package ntp for versions less than 4.2.8p17-3

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttpreadtrailer and merges them into request headers. The fix introduces evhttpparseheadersimpl and a temporary trailer header list. An unauthenticated remote...

CVE-2026-63379 Libevent: HTTP Header smuggling

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttpreadtrailer and merges them into request headers. The fix introduces evhttpparseheadersimpl and a temporary trailer header list. An unauthenticated remote...

CVE-2026-63379 Libevent: HTTP Header smuggling

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttpreadtrailer and merges them into request headers. The fix introduces evhttpparseheadersimpl and a temporary trailer header list. An unauthenticated remote...

CVE-2026-73258

In Mongoose prior to 7.22, mg_http_next_multipart() in src/http.c uses an incorrect AND condition when scanning for CRLF terminators in multipart input. A lone carriage return or line feed causes premature truncation of headers, filenames, or boundaries, allowing an attacker to present a misleadi...

EUVD-2026-63495

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

Linux Distros Unpatched Vulnerability : CVE-2026-68005

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in ACME minihttpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handlerequest function...

CVE-2026-50576

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The...

CVE-2026-50576

CVE-2026-50576 is a CRLF header injection vulnerability in ePA 3.x Integration , a component of Germany's electronic patient record system. The build_inner_header function in app/vau/VAUProtokoll.py interpolates user-controlled values (uri, host, accept_type, content_type, content_length, USER_AG...