RLSA-2026:98088 Important: libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network VPN...

libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS

A null pointer dereference flaw was found in Libreswan's PKCS7 certificate payload handling. When processing a crafted IKEv2 IKEAUTH packet containing a PKCS7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash...

libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS

A null pointer dereference flaw was found in Libreswan's PKCS7 certificate payload handling. When processing a crafted IKEv2 IKEAUTH packet containing a PKCS7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash...

RLSA-2026:97878 Important: libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network VPN...

RHEL 10 : libreswan (RHSA-2026:98088)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:98088 advisory. Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide...

Important: Red Hat Security Advisory: libreswan security update

An update for libreswan is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

npm: Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption

npm: Forge: Incomplete PKCS7 padding validation in AES/DES CBC and ECB decryption vulnerability discovered by ? in WordPress npm node-forge versions = 1.4.0...

EUVD-2026-113333

Forge: Incomplete PKCS7 padding validation in AES/DES CBC and ECB decryption...

GHSA-2VGQ-WCHC-25W7 Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption

Summary decipher.finish in CBC and ECB mode accepted malformed PKCS7 padding: only the last byte was checked, against a limit of four blocks, so mismatched padding bytes, a zero count and oversized counts were accepted and up to four blocks of plaintext could be silently removed. Fixed in...

Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption

Summary decipher.finish in CBC and ECB mode accepted malformed PKCS7 padding: only the last byte was checked, against a limit of four blocks, so mismatched padding bytes, a zero count and oversized counts were accepted and up to four blocks of plaintext could be silently removed. Fixed in...

RHEL 9 : libreswan (RHSA-2026:97878)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:97878 advisory. Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide...

CVE-2026-118776

A flaw was found in node-forge. The library fails to properly validate Public-Key Cryptography Standards 7 PKCS7 padding during Cipher Block Chaining CBC and Electronic Codebook ECB decryption modes by inspecting only the final byte. A remote attacker could exploit this issue by supplying malform...

SUSE CVE-2026-118776

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish, CBC and ECB modes, PKCS7 padding to process the relevant input or security decision. node-forge validated only the final byte of PKC...

Linux Distros Unpatched Vulnerability : CVE-2026-118776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used...

node-forge 1.4.0 Incomplete PKCS#7 Padding Validation

node-forge versions 1.4.0 and below contain incomplete PKCS7 padding validation in AES and DES CBC and ECB decryption. The supplied proof of concept demonstrates malformed ciphertext being accepted as valid padding. https://packetstorm.news/download/238666...

AZL-112481 CVE-2026-118776 affecting package python-tensorboard 2.16.2-6

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish, CBC and ECB modes, PKCS7 padding to process the relevant input or security decision. node-forge validated only the final byte of PKC...

UBUNTU-CVE-2026-118776

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish, CBC and ECB modes, PKCS7 padding to process the relevant input or security decision. node-forge validated only the final byte of PKC...

CVE-2026-118776

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish, CBC and ECB modes, PKCS7 padding to process the relevant input or security decision. node-forge validated only the final byte of PKC...

CVE-2026-118776

The Forge (also known as node-forge ) JavaScript library, a native implementation of Transport Layer Security, is vulnerable to an integrity failure prior to version 1.4.1 . When using decipher.finish() with CBC and ECB modes and PKCS#7 padding, the library incorrectly validated only the final by...

CVE-2026-118776 Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish, CBC and ECB modes, PKCS7 padding to process the relevant input or security decision. node-forge validated only the final byte of PKC...