RHEL 8 : resource-agents (RHSA-2026:47092)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:47092 advisory. The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several servic...

Moderate: resource-agents security update

The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several services to allow operating in a high-availability HA environment. Security Fixes: urllib3: urllib3: Information disclosure via cross-origin redirects...

CVE-2026-42493: Uncontrolled Resource Consumption

Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives HVM/PVH: HAP, PV: shim are commonly available, the decision was to deprecate the functionality, while still retainin...

Apache Tomcat 9.0.0.M1 < 9.0.121 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 9.0.121. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat9.0.121security-9 advisory. - Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issu...

ROS-20260728-73-0012

The vulnerability in Grafana is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

RockyLinux 10 : unbound (RLSA-2026:36320)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:36320 advisory. unbound: Unbound: Denial of Service via excessive EDNS options CVE-2026-41292 unbound: Unbound: Cache manipulation via 'ghost domain names' attack...

Apache Tomcat 10.1.24 < 10.1.58

The version of Tomcat installed on the remote host is prior to 10.1.58. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat10.1.58security-10 advisory. - Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affect...

RockyLinux 9 : unbound (RLSA-2026:36777)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:36777 advisory. unbound: Unbound: Denial of Service via excessive EDNS options CVE-2026-41292 unbound: Unbound: Cache manipulation via 'ghost domain names' attack...

CVE-2026-66299: Uncontrolled Resource Consumption

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

RHEL 8 : resource-agents (RHSA-2026:47091)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:47091 advisory. The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several servic...

ROS-20260728-73-0009

The vulnerability of the HTTP/2 header processing module in the Apache HTTP Server is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data

A flaw was found in Apache Thrift. This vulnerability, categorized as improper handling of highly compressed data also known as data amplification, allows a remote attacker to cause a Denial of Service DoS by sending specially crafted, highly compressed data. The affected component fails to...

DoS (Denial of Service) react-router Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.3.8, 10.7.1, 11.0.0, and 11.1.0 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a DOS in Twisted [CVE-2026-42304]

Summary BM Watson Speech Services Cartridge is vulnerable to a DOS in Twisted, due to a flaw in the twisted.names module that can cause resource exhaustion during DNS name decompression CVE-2026-42304. Twisted is used in our speech runtimes. This vulnerability has been addressed. Please read the...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption vulnerability in Apache HttpComponents [CVE-2026-54399]

Summary IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption vulnerability in Apache HttpComponents, due to a flaw in the HTTP/1.1 message parser CVE-2026-54399. Apache HttpComponents is used in our Java Microservices. This vulnerability has been addressed...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Allocation of resources without limits or throttling vulnerability in Apache HttpComponents [CVE-2026-54428]

Summary IBM Watson Speech Services Cartridge is vulnerable to an Allocation of resources without limits or throttling vulnerability in Apache HttpComponents due to a flaw in HTTP/2 HPACK decoder which could lead to a D.O.S. CVE-2026-54428. Apache HttpComponents is used in our Java Microservices...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework [CVE-2026-41850, CVE-2026-41851, CVE-2026-41852]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework CVE-2026-41850, CVE-2026-41851, CVE-2026-41852. Spring Framework is used as part of our microservices. These vulnerabilities have been addressed. Please read the details for remediation below...

CVE-2026-66759 Gimp: out-of-bounds read in file-icns plugin causes information disclosure or crash on crafted icns images

A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. If a crafted file contains a truncated mask resource, the icnsdecompres...

CVE-2026-66759

The CVE-2026-66759 vulnerability affects GIMP’s file-icns plugin. During ICNS image processing, applying a decompressed mask may cause an out-of-bounds read when the plugin reads the mask data buffer without verifying cursor bounds. If a crafted file contains a truncated mask resource, the icns_d...

CVE-2026-17552 Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call

Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUESTURI concatenation in call. When the rewrite base is a plain string, the REQUESTURI is appended to it, with no check that the path starts with a forward slash '/'. When the rewrite base does...