TencentOS Server 4: openssl (TSSA-2024:0288)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0288 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

Security Bulletin: This Power System update is being released to address CVE-2024-2511

Summary The OpenSSL package is used by the Virtualization Management Interface in PowerVM to support network communication with the Hardware Management Console. This bulletin provides a remediation for the impacted vulnerability, CVE-2024-2511, by upgrading PowerVM and thus addressing the exposur...

golang: crypto/tls: lack of a limit on buffered post-handshake

A flaw was found in Golang. QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With the fix, connections now consistently reject messages larger than 65KiB in size...

OESA-2025-1490 erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson. Security Fixes: Erlang/OTP is a set of libraries for the Erlang...

Vulnerabilities fixed in Keycloak

Red Hat has fixed vulnerabilities in Keycloak. The vulnerabilities include an issue where JWT tokens with long expiration times can cause infinite growth in the cache, resulting in an OutOfMemoryError and a Denial-of-Service for legitimate users. In addition, verification of trust store...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in OpenSSL

Summary Multiple vulnerabilities in OpenSSL used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2024-2511 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by improper server configuration validation. By using a specially crafted server...

GHSA-2935-2WFM-HHPV Keycloak Denial of Service (DoS) Vulnerability via JWT Token Cache

A flaw was found in Keycloak. When the configuration uses JWT tokens for authentication, the tokens are cached until expiration. If a client uses JWT tokens with an excessively long expiration time, for example, 24 or 48 hours, the cache can grow indefinitely, leading to an OutOfMemoryError. This...

RLSA-2024:9333 Low: openssl and openssl-fips-provider security update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: Unbounded memory growth with session handling in TLSv1.3 CVE-2024-2511 openssl: Excessive time...

Linux Distros Unpatched Vulnerability : CVE-2023-39322

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause...

Linux Distros Unpatched Vulnerability : CVE-2022-41717

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by th...

GHSA-VH64-54PX-QGF8 Goroutine Leak in Abacus SSE Implementation

Goroutine Leak in Abacus SSE Implementation Summary A critical goroutine leak vulnerability has been identified in the Abacus server's Server-Sent Events SSE implementation. The issue occurs when clients disconnect from the /stream endpoint, as the server fails to properly clean up resources and...

Goroutine Leak in Abacus SSE Implementation

Goroutine Leak in Abacus SSE Implementation Summary A critical goroutine leak vulnerability has been identified in the Abacus server's Server-Sent Events SSE implementation. The issue occurs when clients disconnect from the /stream endpoint, as the server fails to properly clean up resources and...

AZL-57324 CVE-2025-22868 affecting package vitess for versions less than 19.0.4-5

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

AZL-57309 CVE-2025-22868 affecting package azcopy for versions less than 10.25.1-2

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

AZL-57467 CVE-2025-22868 affecting package telegraf for versions less than 1.29.4-13

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

DEBIAN-CVE-2025-26618

Erlang is a programming language and runtime system for building massively scalable soft real-time systems with requirements on high availability. OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang. Packet si...

AZL-57095 CVE-2025-26618 affecting package erlang for versions less than 25.2-3

Erlang is a programming language and runtime system for building massively scalable soft real-time systems with requirements on high availability. OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang. Packet si...

SUSE CVE-2025-26466

A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to ...

Astra Linux – Vulnerability in OpenSSH

A flaw was discovered in the OpenSSH package. For each ping packet received by the SSH server, a pong packet is allocated in a memory buffer and stored in a queue of packets. This memory buffer is only freed after the server/client key exchange is completed. A malicious client may continue to sen...

Azure Linux 3.0 Security Update: azcopy / containerized-data-importer / cri-o / golang / moby-engine / prometheus / sriov-network-device-plugin (CVE-2022-41717)

The version of azcopy / containerized-data-importer / cri-o / golang / moby-engine / prometheus / sriov-network-device- plugin installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-41717 advisory. - An...