CVE-2026-74656

A flaw was found in the Linux kernel's IPv4 networking stack. A use-after-free vulnerability exists in the fibnhcupdatemtu function due to a race condition during nexthop exception table updates. This allows for a scenario where memory can be freed while still being accessed, which can lead to a...

ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification

A flaw was found in the ip-address library. This library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, is vulnerable to Server-Side Request Forgery SSRF due to incorrect classification of IPv4-mapped/NAT64 IPv6 addresses. An attacker could exploit this misclassificatio...

CVE-2026-74669

In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ipvsinicmp rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmpsend. However, IPCBskb-opt still describes the outer IPv4...

CVE-2026-74669 ipvs: clear IPv4 options after rebasing tunnel ICMP errors

In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ipvsinicmp rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmpsend. However, IPCBskb-opt still describes the outer IPv4...

CVE-2026-74669 ipvs: clear IPv4 options after rebasing tunnel ICMP errors

In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ipvsinicmp rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmpsend. However, IPCBskb-opt still describes the outer IPv4...

EUVD-2026-64356

In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ipvsinicmp rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmpsend. However, IPCBskb-opt still describes the outer IPv4...

CVE-2026-74669

CVE-2026-74669 affects the Linux kernel IPVS component. When ip_vs_in_icmp() rebases an skb from an outer ICMP packet to the quoted original request, the IPCB(skb)->opt field still describes the outer IPv4 header. A timestamp option in that outer header can leave a stale offset pointing into t...

EUVD-2026-64594

In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix fibnlmsgsize for RTAVIA nexthops fibnlmsgsize still estimates nexthop space as if every gateway is encoded as an IPv4 RTAGATEWAY attribute. IPv4 routes can also carry an IPv6 gateway, which fibnexthopinfo dumps as RTAVI...

CVE-2026-74656 ipv4: fix use-after-free in fib_nhc_update_mtu()

In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fibnhcupdatemtu fibnhcupdatemtu walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcudereferenceprotected with a constant tr...

CVE-2026-74656

A use-after-free vulnerability exists in the Linux kernel's IPv4 networking stack, specifically in the fib_nhc_update_mtu() function. The root cause is a race condition : this function walks the nexthop exception table under RTNL, but RTNL does not serialize the walk with concurrent PMTU exceptio...

PT-2026-79674

In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ip vs in icmp rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp send. However, IPCBskb-opt still describes the outer IPv4...

PT-2026-79661

In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fib nhc update mtu fib nhc update mtu walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcu dereference protected with a...

EUVD-2026-63681

The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPublicUrl from src/shared/utils/ssrfGuard.js. That guard compares hostname strings only: it resolves no DNS, does not revalidate...

CVE-2026-72860 9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable

The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPublicUrl from src/shared/utils/ssrfGuard.js. That guard compares hostname strings only: it resolves no DNS, does not revalidate...

CVE-2026-72860 9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable

The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPublicUrl from src/shared/utils/ssrfGuard.js. That guard compares hostname strings only: it resolves no DNS, does not revalidate...

CVE-2026-72860

9router 's POST /api/provider-nodes/validate route is vulnerable to Server-Side Request Forgery (SSRF) due to a flaw in its assertPublicUrl guard (src/shared/utils/ssrfGuard.js). The IPv4-mapped IPv6 denylist regex is unreachable because the WHATWG URL parser canonicalizes such literals to hextet...

PT-2026-79218

The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPublicUrl from src/shared/utils/ssrfGuard.js. That guard compares hostname strings only: it resolves no DNS, does not revalidate...

CVE-2026-16839

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to an integer underflow in the IPv4 IP-options parser...

CVE-2026-16839

Affected products: IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1. Root cause: integer underflow in the IPv4 IP-options parser, exploitable remotely with no authentication. Impact: CVSS 9.4 (Critical) — high integrity/availability, low confidentiality. Exploitation status: no in-the-wild exploitation or ...

CVE-2026-16839 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to an integer underflow in the IPv4 IP-options parser...