curl: 08: CVE-2026-7009 fix incomplete for AWS-LC: `--cert-status` bypass on SecTrust path

Summary The fix for CVE-2026-7009 commit 51905671e0 does not cover AWS-LC. In osslappleverify in lib/vtls/openssl.c, a missing OCSP staple is detected only when SSLgettlsextstatusocspresp returns a negative length. OpenSSL returns -1 for absence, but AWS-LC returns 0 with a NULL output pointer. O...

curl: 06: Incomplete fix for CVE-2026-7009: GCC/SecTrust builds silently discard stapled OCSP responses

Summary Curlvtlsappleverify in lib/vtls/apple.c passes the stapled OCSP response to SecTrustSetOCSPResponse only when both HAVEBUILTINAVAILABLE and SUPPORTSSecOCSP are defined. When HAVEBUILTINAVAILABLE is absent, the OCSP buffer is silently discarded. GCC does not support builtinavailable, so th...

EulerOS Virtualization 2.13.0 : gnutls (EulerOS-SA-2026-3213)

According to the versions of the gnutls packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels,...

CVE-2026-55162

Netflix Lemur versions before 1.9.2 are vulnerable to post-authentication SSRF: lemur/certificates/verify.py passes attacker-controlled CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions directly to requests.get() and openssl ocsp without destination validation, e...

EUVD-2026-61149

Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions and used them in crlverify and ocspverify without adequate destination validation. An authenticated operator could subm...

Oracle Linux 10 : tomcat9 (ELSA-2026-36790)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-36790 advisory. - Resolves: RHEL-150720 Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 - Resolves: Tomcat: OCSP checks...

tomcat security update

1:9.0.117-1 - Resolves: RHEL-150714 Certificate revocation bypass due to improper OCSP response validation - Resolves: Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled CVE-2026-34500 - Resolves: Tomcat: Cloud membership for clustering component exposed the Kubernet...

Oracle Linux 9 : tomcat (ELSA-2026-18916)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-18916 advisory. - Resolves: Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled CVE-2026-34500 - Resolves: Tomcat: Cloud membership for...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in tomcat-embed-core-11.0.15.jar

Summary IBM Watson Discovery Cartridge affected by vulnerability in tomcat-embed-core-11.0.15.jar Vulnerability Details CVEID:CVE-2026-24734 DESCRIPTION: Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native and Tomcat's FFM po...

SUSE-SU-2026:20926-1 Security update for tomcat11

This update for tomcat11 fixes the following issues: Update to Tomcat 11.0.18: - CVE-2025-66614: client certificate verification bypass due to virtual host mapping bsc1258371. - CVE-2026-24733: improper input validation on HTTP/0.9 requests bsc1258385. - CVE-2026-24734: certificate revocation...

OPENSUSE-SU-2026:20350-1 Security update for tomcat

This update for tomcat fixes the following issues: Update to Tomcat 9.0.115: - CVE-2025-66614: client certificate verification bypass due to virtual host mapping bsc1258371. - CVE-2026-24733: improper input validation on HTTP/0.9 requests bsc1258385. - CVE-2026-24734: certificate revocation bypas...

SUSE CVE-2026-24734

Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native and Tomcat's FFM port of the Tomcat Native code did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypasse...

Fixed in Apache Tomcat 10.1.52

Moderate: Incomplete OCSP verification checks CVE-2026-24734 When using an OCSP responder, Tomcat's FFM integration with OpenSSL did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed. Affects: 10.1.0-M7 to 10.1.51 This issue...

Fixed in Apache Tomcat 9.0.115

Moderate: Incomplete OCSP verification checks CVE-2026-24734 When using an OCSP responder, Tomcat's FFM integration with OpenSSL did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed. Affects: 9.0.83 to 9.0.114 This issue wa...

MiracleLinux 8 : curl-7.61.1-18.el8 (AXSA:2021-1956:03)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-1956:03 advisory. curl: FTP PASV command response can cause curl to connect to arbitrary host CVE-2020-8284 curl: Malicious FTP server can trigger stack overflow when...

MiracleLinux 3 : openssl-0.9.8e-26.AXS3.1 (AXSA:2013-126:01)

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2013-126:01 advisory. The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries...

MiracleLinux 3 : ruby-1.8.5-5.7.1AXS3 (AXSA:2009-78:01)

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2009-78:01 advisory. Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system...

EUVD-2021-25039

Malware in sbrugna...

EUVD-2021-10165

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2021-38597

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wolfSSL before 4.8.1 incorrectly skips OCSP verification in certain situations of irrelevant response data that contains the NoCheck extension. CVE-2021-38597...