Rocky Linux 10.2 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / libcurl / etc Multiple Vulnerabilities (crlsa-2026_69125)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202669125 advisory. libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-8932 curl: curl: Information disclosure via incorrect .netrc...

Rocky Linux 9.6 [TuxCare] Security Update: libkcapi / libkcapi-devel / libkcapi-doc / libkcapi-fipscheck / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786699908)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786699908 advisory. - A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs over 64 KiB in stateful modes...

AlmaLinux 9.2 [TuxCare] Security Update: libkcapi / libkcapi-devel / libkcapi-doc / libkcapi-fipscheck / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786719033)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786719033 advisory. - A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs over 64 KiB in stateful modes...

CentOS Linux 7 [TuxCare] Security Update: curl / libcurl / libcurl-devel (CENTOS7:CLSA-2026:1785400806)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1785400806 advisory. - A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though th...

Rocky Linux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786091577)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786091577 advisory. - libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are...

AlmaLinux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785925031)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785925031 advisory. - When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear...

AlmaLinux 9.2 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1785925784)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785925784 advisory. - When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear...

PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

Summary PyJWT.decode/decodecomplete mutates a caller-supplied options dict in place whenever verifysignature is falsy, adding verifyexp/verifynbf/verifyiat/verifyaud/verifyiss/verifysub/verifyjti keys directly onto that object. If application code reuses the same options dict across calls a confi...

CVE-2026-103001

A flaw was found in pyjwt. This vulnerability allows a remote attacker to bypass token validation checks when an application reuses an options configuration across multiple token decoding requests. Because the library unintentionally modifies the caller's shared configuration dictionary when...

CentOS Linux 7 [TuxCare] Security Update: curl / libcurl / libcurl-devel Multiple Vulnerabilities (CENTOS7:CLSA-2023:1697816385)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2023:1697816385 advisory. - libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited...

AlmaLinux 9.2 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal (ALMALINUX9.2:CLSA-2026:1778890582)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778890582 advisory. - libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTPS request after a...

CentOS Linux 8 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1774366368)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1774366368 advisory. - libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request...

AlmaLinux 9.2 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2024:1719943814)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1719943814 advisory. - An authentication bypass vulnerability exists libcurl 8.0.0 in the connection reuse feature which can reuse previously established...

CentOS Linux 6 [TuxCare] Security Update: haproxy (CENTOS6:CLSA-2026:1776337242)

The CentOS Linux 6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1776337242 advisory. - A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the chunked value were not bein...

CVE-2026-92899: Authentication Bypass by Spoofing

Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticat...

CentOS Linux 8 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal (CENTOS-STREAM8:CLSA-2026:1786034295)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1786034295 advisory. - libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have...

CentOS Linux 8 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal (CENTOS-STREAM8:CLSA-2026:1785421291)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1785421291 advisory. - A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even...

AlmaLinux 9.2 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786094315)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786094315 advisory. - libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are s...

AlmaLinux 9.2 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal (ALMALINUX9.2:CLSA-2026:1783705168)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783705168 advisory. - Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origin to a...

SUSE CVE-2026-100666

Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...