OESA-2026-4193 bind security update

Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server. Security Fixes: If a BIN...

OESA-2026-4191 bind security update

Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server. Security Fixes: If a BIN...

CVE-2026-92960

A flaw was found in vm2. In configurations allowing built-in modules, vm2 fails to restrict access to the host operating system and Domain Name System DNS modules. An attacker who can execute code inside the sandbox can exploit this flaw to hijack the host process DNS resolver, redirecting outbou...

CentOS Linux 8.5 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-export-devel / etc (CENTOS8.5:CLSA-2026:1786033455)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1786033455 advisory. - A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The...

AlmaLinux 9.2 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-dnssec-doc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1780406442)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780406442 advisory. - BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a...

CentOS Linux 8 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-libs (CENTOS-STREAM8:CLSA-2026:1768395381)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1768395381 advisory. - A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the...

PT-2026-102972

Name of the Vulnerable Software and Affected Versions Handlebars.java versions prior to 4.5.5 Description An issue allows directory traversal when using a Spring MVC application with a file: template prefix and a request-derived view name. In certain versions, template locations are validated as...

AlmaLinux 9.2 [TuxCare] Security Update: ldns / ldns-devel / ldns-doc / ldns-utils / perl-ldns / etc (ALMALINUX9.2:CLSA-2026:1784986614)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784986614 advisory. - NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as stub resolver over UDP, lacks matching the query...

AlmaLinux 9.2 [TuxCare] Security Update: oci-seccomp-bpf-hook (ALMALINUX9.2:CLSA-2026:1784707996)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784707996 advisory. - When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

Rocky Linux 9.6 [TuxCare] Security Update: oci-seccomp-bpf-hook / oci-seccomp-bpf-hook-tests (ALMALINUX9.6:CLSA-2026:1784646805)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784646805 advisory. - When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

AlmaLinux 9.6 [TuxCare] Security Update: oci-seccomp-bpf-hook / oci-seccomp-bpf-hook-tests (ALMALINUX9.6:CLSA-2026:1784646805)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784646805 advisory. - When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

CLEANSTART-2026-IJ88105 In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver

Security vulnerability affects the elasticsearch package. In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

Exploit for CVE-2026-100721

CVE-2026-100721 — vm2 NodeVM external allowlist bypass Python...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

Duplicate Advisory: vm2: NodeVM custom resolution bypasses external path boundaries

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5h3f-q97h-ccvc. This link is maintained to preserve external references. Original Description vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configure...

GHSA-C9WR-QM7P-P6VC Duplicate Advisory: vm2: NodeVM custom resolution bypasses external path boundaries

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5h3f-q97h-ccvc. This link is maintained to preserve external references. Original Description vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configure...

Incorrect Authorization

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Incorrect Authorization via LegacyResolver.isPathAllowed in lib/resolver-compat.js, which uses a raw path.startsWithmod.path check to...

CVE-2026-100721

vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures require.external with a custom resolver and context: 'host', LegacyResolver.customResolve in lib/resolver-compat.js records the resolved module directory in this.externals as new...