curl: CURLOPT_PROXYHEADER is not part of the HTTP-proxy connection reuse key: a second CONNECT-tunnel transfer silently reuses the first tunnel's Proxy-Auth

Summary When libcurl tunnels through an HTTP proxy with CONNECT HTTPS-over-proxy, the custom headers set via CURLOPTPROXYHEADER are sent to the proxy once, at tunnel-setup time lib/httpproxy.c:63-83. The connection-reuse decision for a proxied connection, however, does not take proxyheaders into...

CVE-2026-98805: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent GCM nonce reuse on peer key changes TIPC can encrypt traffic between nodes using a different transmit key for each node. In this mode, the AES-GCM nonce for a packet sent to a known peer consists of a 32-bit prefix ...

PT-2026-117024

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent GCM nonce reuse on peer key changes TIPC can encrypt traffic between nodes using a different transmit key for each node. In this mode, the AES-GCM nonce for a packet sent to a known peer consists of a 32-bit prefix ...

Linux Distros Unpatched Vulnerability : CVE-2026-98805

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tipc: prevent GCM nonce reuse on peer key changes TIPC can encrypt traffic between nodes using a different transmit key for each node. In this mode, the AES-GCM...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.19 contains security vulnerabilities. These vulnerabilities stem from binderfs’ binderadddevice function, which accesses freed objects after simpledonecreating releases the parent directory lock and dentry references. Concurrently, unlinkat can delete the new device ent...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.18 contains security vulnerabilities. These vulnerabilities arise from the lack of cancellation of the wake-up process when a device is removed. Additionally, remote wake-up requests may re-trigger this process after it has been canceled, leading to reuse after release...

Linux Kernel Security Vulnerabilities

There are security vulnerabilities in Linux kernels versions from 3.2.99 to 3.3, from 3.16.54 to 3.17, from 3.18.94 to 3.19, from 4.1.50 to 4.2, from 4.4.115 to 4.5, from 4.9.78 to 4.10, from 4.14.15 to 4.15, and version 4.15. The vulnerability stems from ALSA’s handling of ioctl commands for...

Linux Kernel Security Vulnerabilities

There are security vulnerabilities in Linux kernels versions 5.15.17 to 5.16, 5.16.3 to 5.17, and 5.17 itself. These vulnerabilities stem from the iio trigger not canceling reenablework before releasing the trigger. The worker that was last started via an ongoing IRQ can continue to run after...

Linux Kernel Security Vulnerabilities

There are security vulnerabilities in Linux kernels versions 5.10.28 to 5.11, 5.11.11 to 5.12, and 5.12 itself. These vulnerabilities stem from the BPF trampoline program failing to skip the already separated programs that are still in use during separation. As a result, task sleep may call upon...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.13 contains a security vulnerability. This vulnerability stems from the HID multitouch driver, which does not prevent the timer from being re-activated when it is removed, allowing for reuse after release...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.12 has a security vulnerability. This vulnerability arises from the use of usbdisableendpoint, which only clears one direction of the epin or epout when non-ep0 control endpoints are disabled and resethardware is set. As a result, the other direction array slot still...

Linux Kernel Security Vulnerabilities

The Linux kernel version 3.19 has a security vulnerability. This vulnerability stems from improper locking and serialization in Bluetooth SMP remote OOB data access. The buildpairingcmd function searches for and copies remote OOB data without holding the hdev-lock. This may lead to post-release...

Linux Kernel Security Vulnerabilities

The Linux kernel version 3.14 contains a security vulnerability. This vulnerability arises from the failure to cancel the PS delivery process promptly when deleting an AP or mesh station. The function stadeliverpsframes only checks sta-dead before delivery. As a result, delayed work threads may...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.4 contains security vulnerabilities. These vulnerabilities stem from the use of meshfasttxcache, which stores original meshpath pointers. After deleting and clearing the cache, searches for existing paths may still insert new cache entries, causing the cache to point to...

Linux Kernel Security Vulnerabilities

The Linux kernel version 5.9 contains security vulnerabilities. These vulnerabilities arise when the controller path that creates the multipath namespace is removed for the first time, causing the I/O direct access command to trigger a release followed by reuse of resources...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability stems from the sctpwaitforconnect function releasing the socket lock during sleep. Additionally, the shutdown mechanism does not check this state before reusing the connection after setting RCVSHUTDOWN. This could lead to the...

Linux Kernel Security Vulnerabilities

The Linux kernel version 3.3 has a security vulnerability. This vulnerability stems from the use of hcichansent, which accesses chan-conn after releasing the RCU read lock and returns the channel. The ACL and LE scheduler utilize their data packet queues and update the send counter even when...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.30 contains a security vulnerability. This vulnerability arises from the max3100 serial port driver returning values prematurely when the system is suspended. The polling timer is not closed before releasing the port. When the SPI device unlinks before it recovers, it...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.6 contains security vulnerabilities. These vulnerabilities stem from a lack of synchronization in the allocbulk function of bpf when processing lists like waitingforgpttrace and freebyrcuttrace concurrently. This leads to race conditions and allows for reuse of resource...

CVE-2026-109369

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 2.1.0.3 . The root cause is the plugin's failure to properly verify user authorization when performing actions. Authenticated attackers with subscriber-level ...