EUVD-2026-70248

HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated...

GHSA-PF96-P4FJ-6566 HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

Summary HTTPX2 can automatically add a Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. The resulting HTTP/1.1 request contains both framing headers, which can create an ambiguous message boundary and enable request smuggling or connection...

kernel: net: add pskb_may_pull() to skb_gro_receive_list()

A flaw was found in the Linux kernel's network Generic Receive Offload GRO handling. An attacker sending specially crafted network packets could trigger a bug in the skbgroreceivelist function. This occurs when the system attempts to process network data that is not in the expected linear memory...

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

RHEL 10 : kernel (RHSA-2026:65334)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65334 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: KVM: nSVM: Always use vmcb01...

EulerOS 2.0 SP12 : perl (EulerOS-SA-2026-3289)

According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, packipmreqsource checks the length of its source argument befor...

PT-2026-88520

A flaw was found in DPDK lib/vhost. Missing length validation before reading command data in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash...

EulerOS 2.0 SP12 : perl (EulerOS-SA-2026-3364)

According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, packipmreqsource checks the length of its source argument befor...

EulerOS 2.0 SP12 : nghttp2 (EulerOS-SA-2026-3361)

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...

EulerOS 2.0 SP12 : nghttp2 (EulerOS-SA-2026-3286)

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...