net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CLEANSTART-2026-TK74807 net/url package does not set a limit on the number of query parameters in a query

Security vulnerability affects the nfs-subdir-external-provisioner package. The net/url package does not set a limit on the number of query parameters in a query...

kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch

A flaw was found in the Linux kernel's networking scheduler, specifically within the taprio module. When the system attempts to switch schedules, a use-after-free vulnerability occurs in the advancesched function. This happens because a pointer to an old schedule entry is still used after the...

kernel: net/iucv: fix use-after-free of a severed iucv_path

A flaw was found in the Linux kernel. This use-after-free vulnerability exists in the net/iucv component. When a peer severs a connection, message notifications that still reference the freed connection path remain in a queue. A subsequent attempt to process these stale notifications can lead to...

kernel: net/sched: act_ct: Only release RCU read lock after ct_ft

A flaw was found in the Linux kernel. A race condition in the actct module, specifically during the flow table lookup, can lead to a Use-After-Free UAF vulnerability. This occurs because a critical lock is released prematurely, allowing a memory object to be freed while still in use. An attacker...

RHCOS 4 : OpenShift Container Platform 4.19.51 (RHSA-2026:79166)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:79166 advisory. - net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGSMAXFRAMESIZE frame CVE-2026-33814 No...

RHCOS 4 : OpenShift Container Platform 4.18.57 (RHSA-2026:79034)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:79034 advisory. - net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGSMAXFRAMESIZE frame CVE-2026-33814 No...

PT-2026-122826

Security vulnerability affects the nfs-subdir-external-provisioner package. The net/url package does not set a limit on the number of query parameters in a query...

RHCOS 4 : Red Hat build of MicroShift 4.18.57 (RHSA-2026:80167)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:80167 advisory. - net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGSMAXFRAMESIZE frame...

kernel security, bug fix, and enhancement update

6.12.0-211.66.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

Linux Distros Unpatched Vulnerability : CVE-2026-98432

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: free inetopt and ireqopt after an RCU grace period tcpv4synrecvsock transfers ownership of ireq-ireqopt to the child socket newinet-inetopt without copyin...

kernel security update

5.14.0-687.58.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

RHCOS 4 : OpenShift Container Platform 4.16.73 (RHSA-2026:77611)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:77611 advisory. - golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-3982...

Microsoft .NET Framework (October 2026)

The Microsoft .NET Framework installation on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities, including the following: - Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network. CVE-2026-70007 -...

RHCOS 4 : OpenShift Container Platform 4.17.59 (RHSA-2026:77547)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:77547 advisory. - net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGSMAXFRAMESIZE frame CVE-2026-33814 No...

SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4660-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4660-1 advisory. The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: -...

kernel: net/sched: act_ct: Only release RCU read lock after ct_ft

A flaw was found in the Linux kernel. A race condition in the actct module, specifically during the flow table lookup, can lead to a Use-After-Free UAF vulnerability. This occurs because a critical lock is released prematurely, allowing a memory object to be freed while still in use. An attacker...

kernel: net/iucv: fix use-after-free of a severed iucv_path

A flaw was found in the Linux kernel. This use-after-free vulnerability exists in the net/iucv component. When a peer severs a connection, message notifications that still reference the freed connection path remain in a queue. A subsequent attempt to process these stale notifications can lead to...