RHCOS 4 : OpenShift Container Platform 4.20.41 (RHSA-2026:74376)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:74376 advisory. - net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGSMAXFRAMESIZE frame CVE-2026-33814 No...

ROS-20261007-73-0392

The vulnerability of the buildreport function in the net/xfrm/xfrmuser.c module of the Linux kernel is related to the use of an uninitialized resource. Exploiting this vulnerability could allow an attacker to cause a service failure...

ROS-20261007-73-0404

The vulnerability of the skdiagdumpname function in the net/unix/diag.c module, which is part of the Linux kernel’s networking functions, stems from the lack of protection for service data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

MiracleLinux 9 : osbuild-composer-165.1-5.el9_8.ML.1 (AXSA:2026-1978:12)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1978:12 advisory. golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-27136 golang.org/x/net/html:...

CVE-2026-19186: Integer Underflow (Wrap or Wraparound)

ieee802154decipherdataframe in subsys/net/l2/ieee802154/ieee802154frame.c computed payloadlen = netpktgetlenpkt - llhdrlen - authtaglen without first checking that the received frame is at least llhdrlen + authtaglen bytes long. All three variables are uint8t, so a frame whose payload is shorter...

ROS-20261007-73-0069

The vulnerability of the cfg80211pmsrwdevdown function in the net/wireless/pmsr.c module, which supports wireless communication in Linux kernel, is related to the race condition that occurs when a shared resource is used. Exploiting this vulnerability could allow an attacker to compromise the...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2026-500375)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500375 advisory. - net: tun: bound receive headroom Asim Viladi Oglu Manizada Orabug: 40020673 CVE-2026-81000 - xfrm: ah6: validate routing header segmentsleft As...

ROS-20261007-73-0376

The vulnerability of the tipcgroupprotorcv function in the net/tipc/group.c module of the TIPC protocol implementation in Linux’s operating system is related to the possibility of integer overflow. Exploiting this vulnerability could allow an attacker to cause a service failure...

ROS-20261007-73-0378

The vulnerability of the buildpolexpire function in the net/xfrm/xfrmuser.c module, which is part of the networking functions in the Linux kernel, relates to the use of uninitialized resources. Exploiting this vulnerability could allow an attacker to cause a service failure...

Ubuntu 22.04 LTS : Go vulnerability (USN-8883-1)

The remote Ubuntu 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8883-1 advisory. It was discovered that the Go x/net/idna package incorrectly handled certain Punycode-encoded labels that decoded to ASCII-only labels. An attacker could possibly...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.41 packages and security update

Red Hat OpenShift Container Platform release 4.20.41 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.41 security and extras update

Red Hat OpenShift Container Platform release 4.20.41 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a security impact of...

Improper Output Neutralization for Logs

Overview Affected versions of this package are vulnerable to Improper Output Neutralization for Logs in the %aspnet-request pattern converter, which reads HttpRequest.Params and so triggers ASP.NET request validation on the query string, form, and cookies at first access, raising an...

CLSA-2026-1791320512 osbuild-composer: Fix of CVE-2026-42502

CVE-2026-42502: treat foster-parented raw-text elements in foreign content as escaped rather than literal in the vendored golang.org/x/net/html renderer, preventing a cross-site scripting bypass when a parsed tree is re-rendered...

DEBIAN-CVE-2026-105242

Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A...

CVE-2026-105242 Apache log4net: Request validation failure drops the event in the aspnet-request converter

Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A...

CVE-2026-105242

The Apache log4net logging framework (versions 1.2.11 through 3.5.0 ) is vulnerable to an Improper Handling of Exceptional Conditions (CWE-755) in the aspnet-request pattern converter. When reading request parameters, certain content—such as markup—triggers ASP.NET request validation , causing th...

CVE-2026-105242 Apache log4net: Request validation failure drops the event in the aspnet-request converter

Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A...

CVE-2026-105242

Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A...