Oracle Linux 8 : httpd:2.4 (ELSA-2026-42828)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42828 advisory. - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 -...

TencentOS Server 2: freerdp (TSSA-2026:0753)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0753 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

Logto Identity Platform has authentication and authorization failures in core protocol handling

Overview The Logto platform contains multiple vulnerabilities affecting the identity‑processing pipeline. These flaws reduce the reliability of authentication and authorization decisions and may allow attackers to bypass account‑ownership checks, skip MFA, replay externally issued SSO responses, ...

Oracle Linux 9 : kernel (ELSA-2026-43307)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-43307 advisory. - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels Antoine Tenart RHEL-179297 CVE-2026-46099 - fanotify: fix false positive on permission events...

TencentOS Server 2: freerdp (TSSA-2026:0754)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0754 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

CVE-2026-16632

CVE-2026-16632 affects boazsegev facil.io up to 0.7.4, specifically the WebSocket Frame Parser component. The vulnerability is in websocket_on_protocol_error (library file lib/facil/http/parsers/websocket_parser.h) where manipulation of the on_message argument leads to improper input validation. ...

Eclipse Jetty: HTTP Authority/Host mismatch

Summary Jetty currently accepts HTTP/2 and HTTP/3 requests where the regular Host header and the pseudo-header :authority do not match. As a result, the same request can carry two different host identities through Jetty: - logic based on HttpURI / Request.getServerNamerequest uses :authority -...

GHSA-7488-6R32-C95Q LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

Impact LiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. The MCP auth handler supported OAuth2 passthrough for upstream MCP servers, but the fallback path could replace failed LiteLLM key...

Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address

Security Vulnerability Report: HAProxy V1 Protocol CRLF Injection via AFUNIX Address in Netty 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final and all prior versions with codec-haproxy | | Component |...

GHSA-WH89-7897-X99H Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address

Security Vulnerability Report: HAProxy V1 Protocol CRLF Injection via AFUNIX Address in Netty 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final and all prior versions with codec-haproxy | | Component |...

GHSA-C69G-56F8-XWQJ Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass

Netty's HTTP/2-to-HTTP/1.x translation layer Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter fails to deduplicate or validate Host headers when an HTTP/2 client supplies both the :authority pseudo-header and a literal host header in a single HEADERS frame. The translator maps...

Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass

Netty's HTTP/2-to-HTTP/1.x translation layer Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter fails to deduplicate or validate Host headers when an HTTP/2 client supplies both the :authority pseudo-header and a literal host header in a single HEADERS frame. The translator maps...

GHSA-Q4F6-JM68-57WW Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

Impact HttpContentEncoder the superclass of the production handler HttpContentCompressor maintains a per-channel ArrayDeque named acceptEncodingQueue that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained...

Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

Summary An attacker can force WebSocket upgrade via the lax V07 or V08 handshaker by sending Sec-WebSocket-Version: 7 and omitting Connection: Upgrade / Upgrade: websocket headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request...

Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

Description: An attacker, who controls the HTML input supplied to dompdf, can read arbitrary images from the server’s file system, bypassing the chroot restriction. The vulnerability is exploitable in the default configuration. Exploitation conditions: An external user Researcher: Nikita Sveshnik...

Netty: [codec-haproxy] Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion

The HAProxyMessageDecoder in netty's codec-haproxy module performs protocol version detection by reading the 13th byte of the inbound stream as a signed Java byte and widening it to int without masking. When an attacker sends a PROXY protocol v2 binary prefix 0D 0A 0D 0A 00 0D 0A 51 55 49 54 0A...

EUVD-2026-46438

Netty: codec-haproxy Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion...

Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

Summary Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has already exceeded maxHeaderSize and marked the frame truncated. At commit b2d2137c4404af425bf9d5d601a62576f5c06925, a 12,253-byte compressed SPDY header block can declare and inflat...

GHSA-MVH2-CRG5-V77C Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

Summary Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has already exceeded maxHeaderSize and marked the frame truncated. At commit b2d2137c4404af425bf9d5d601a62576f5c06925, a 12,253-byte compressed SPDY header block can declare and inflat...

Netty SPDY SETTINGS frame count materializes unbounded settings map

Summary Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in DefaultSpdySettingsFrame without an implementation-level count cap. A remote SPDY/3.1 peer can send one syntactically valid roughly 2...