net/http: Request smuggling due to acceptance of invalid chunked data in net/http

A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...

NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2025-6543

Severity - Critical Description of Problem A vulnerability has been discovered in NetScaler ADC formerly Citrix ADC and NetScaler Gateway formerly Citrix Gateway. Refer below for further details. Affected Versions The following supported versions of NetScaler ADC and NetScaler Gateway are affecte...

net/http: Request smuggling due to acceptance of invalid chunked data in net/http

A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...

[SECURITY] Fedora 41 Update: dotnet8.0-8.0.117-1.fc41

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

The vulnerability of the tcf_mirred_to_dev() function in the net/sched/act_mirred.c module of the network/scheduling subsystem of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the tcfmirredtodev function in the net/sched/actmirred.c module of the network/scheduling subsystem of the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to cause a service failure...

ALSA-2025:9634 Moderate: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes: net/http:...

Fedora 42 : dotnet8.0 (2025-fa1fdd193f)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-fa1fdd193f advisory. This is the June 2025 monthly update for .NET 8. Release Notes: - SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.17/8.0.117.md - Runtime...

The vulnerability of the fib_nh_match() function in the net/ipv4/fib_semantics.c module of the Linux operating system’s IPv4 kernel implementation allows a attacker to cause a service failure.

The vulnerability of the fibnhmatch function in the net/ipv4/fibsemantics.c module of the Linux operating system’s IPv4 kernel implementation is related to buffer overflow attacks. Exploiting this vulnerability can allow an attacker to cause a service failure...

Fedora 41 : dotnet8.0 (2025-433fb98ceb)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-433fb98ceb advisory. This is the June 2025 monthly update for .NET 8. Release Notes: - SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.17/8.0.117.md - Runtime...

Security update for kernel-livepatch-MICRO-6-0_Update_3

This update for kernel-livepatch-MICRO-6-0Update3 fixes the following issues: CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inetcreate bsc1235231 CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing bsc1233708 CVE-2024-50301: security/keys: fix...

Security update for kernel-livepatch-MICRO-6-0_Update_2

This update for kernel-livepatch-MICRO-6-0Update2 fixes the following issues: CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inetcreate bsc1235231 CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing bsc1233708 CVE-2024-50301: security/keys: fix...

SUSE-SU-2025:20448-1 Security update for kernel-livepatch-MICRO-6-0_Update_2

This update for kernel-livepatch-MICRO-6-0Update2 fixes the following issues: - CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inetcreate bsc1235231 - CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing bsc1233708 - CVE-2024-50301: security/keys:...

SUSE-SU-2025:20435-1 Security update for kernel-livepatch-MICRO-6-0-RT_Update_3

This update for kernel-livepatch-MICRO-6-0-RTUpdate3 fixes the following issues: - CVE-2024-50124: Bluetooth: ISO: Fix UAF on isosocktimeout bsc1232927 - CVE-2024-50127: net: sched: fix use-after-free in tapriochange bsc1232908 - CVE-2024-50125: Bluetooth: SCO: Fix UAF on scosocktimeout bsc123292...

Security update for the Linux Kernel (Live Patch 57 for SLE 12 SP5)

This update for the Linux Kernel 4.12.14-122219 fixes several issues. The following security issues were fixed: CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inetcreate bsc1235231. CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing bsc1233708...

golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect

A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header redirected to b.com/ will not send that header to b.com. However, the...

SUSE-SU-2025:02076-1 Security update for the Linux Kernel RT (Live Patch 1 for SLE 15 SP6)

This update for the Linux Kernel 6.4.0-150600105 fixes several issues. The following security issues were fixed: - CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inetcreate bsc1235231. - CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing...

Security update for the Linux Kernel (Live Patch 59 for SLE 12 SP5)

This update for the Linux Kernel 4.12.14-122225 fixes several issues. The following security issues were fixed: CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inetcreate bsc1235231. CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing bsc1233708...

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix invalid address access in lookuprec when index is 0 CVE-2023-53075 In the Linux kernel, the following vulnerability has been resolved: ext4: fix task hung in ext4xattrdeleteinode CVE-2023-53089 In the...

CVE-2025-49015

The Couchbase .NET SDK client library before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default...

net/http: Request smuggling due to acceptance of invalid chunked data in net/http

A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...