Rocky Linux 9 [CIQ] Security Update: nodejs-packaging / nodejs-packaging-bundler Multiple Vulnerabilities (crlsa-2023_2654)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20232654 advisory. glob-parent: Regular Expression Denial of Service CVE-2021-35065 c-ares: buffer overflow in configsortlist due to missing string length check CVE-2022-4904...

Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2023_1582)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20231582 advisory. glob-parent: Regular Expression Denial of Service CVE-2021-35065 c-ares: buffer overflow in configsortlist due to missing string length check CVE-2022-4904...

SUSE CVE-2026-93748

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to...

SUSE CVE-2026-93750

http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the varyMatches function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intende...

CVE-2026-93750

A flaw was found in http-cache-semantics. This vulnerability allows a remote attacker to disclose sensitive information across clients. The varyMatches function fails to properly validate Vary header wildcards, enabling an attacker to request URLs previously fetched by other clients and receive...

CVE-2026-93748

A flaw was found in http-cache-semantics. This vulnerability allows unauthenticated attackers to retrieve cached responses, including sensitive session credentials like Set-Cookie values, belonging to other users. This occurs because the component fails to properly validate security-zeroed cache...

Linux Distros Unpatched Vulnerability : CVE-2026-93748

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticate...

Linux Distros Unpatched Vulnerability : CVE-2026-93750

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the varyMatches function that fails to properly validate Vary header wildcards d...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client max-stale directives. An unauthenticated attacker can request the same URL with a large max-stale value to retrieve cached responses...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the varyMatches function, which fails to properly handle Vary: wildcard headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached...

GHSA-CH52-4W7C-C8XP Withdrawn Advisory: http-cache-semantics max-stale handling can disclose cross-user cached responses

Withdrawn Advisory This advisory has been withdrawn because it's not a valid vulnerability. This link is maintained to preserve external references. Original Description http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale...

Withdrawn Advisory: http-cache-semantics max-stale handling can disclose cross-user cached responses

Withdrawn Advisory This advisory has been withdrawn because it's not a valid vulnerability. This link is maintained to preserve external references. Original Description http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale...

DEBIAN-CVE-2026-93748

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to...

AZL-103448 CVE-2026-93748 affecting package nodejs-nodemon 2.0.3-5

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to...

AZL-103485 CVE-2026-93748 affecting package python-tensorboard 2.16.2-6

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to...

DEBIAN-CVE-2026-93750

http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the varyMatches function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intende...

CVE-2026-93750

http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the varyMatches function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intende...

CVE-2026-93748

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to...

UBUNTU-CVE-2026-93748

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to...

CVE-2026-93748

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to...