ALSA-2026:87070 Important: php security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error...

ALSA-2026:87071 Important: php8.4 security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

ALSA-2026:87151 Important: php security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error...

GPAC MP4Box security vulnerability

A security vulnerability exists in GPAC MP4Box versions prior to 2.5. This vulnerability stems from a use-after-free issue in the gfodfac4cfgcleanlist function located in /odf/descriptors.c. Attackers can exploit this by providing a specially crafted AC4 file, resulting in a denial of service...

Important: openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fixes:...

ROS-20261021-73-0079

The vulnerability in ElasticSearch is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

CVE-2025-60469

The GPAC Project/MP4Box software, in versions prior to 2.5 , contains a NULL pointer dereference vulnerability within the gf_ac4_presentation_ch_mode function located in /media_tools/av_parsers.c. This flaw allows an attacker to cause a Denial of Service (DoS) by providing a specially crafted AC4...

PT-2026-120570

The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check is full package, after which the parser reads the response ty...

jackson-core security update

2.21.6-1.2 - Resolves: RHEL-286626 - CVE-2026-89425 jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing unbounded StringBuilder growth during malformed token processing 2.21.6-1.1 - Resolves: RHEL-272199 - Fix CVE-2026-89407...

ALSA-2026:86706 Moderate: jackson-core security update

Core part of Jackson that defines Streaming API as well as basic shared abstractions. Security Fixes: com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking CVE-2026-89407 com.fasterxml.jackson.core/jackson-core:...

Apache Traffic Server resource management error vulnerability

Versions 9.2.15, 10.1.4, and 10.2.0 of Apache Traffic Server contain a resource management error vulnerability. This vulnerability arises because unrestricted diagnostic log entries are written for each stripped internal @header. Requests containing numerous such headers cause the proxy to write...

ROS-20261021-73-0085

The vulnerability in ElasticSearch is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

Apache AsterixDB 0.9.9 Missing Authentication

Summary Apache AsterixDB is a highly scalable data management system that can store, index, and manage semi-structured data, e.g., much like MongoDB, but it also supports a full-power query language with the expressiveness of SQL and more. Unlike analytics engines like Apache Hive or Apache Spark...

CVE-2025-71438

An out-of-bounds read in gfodfac4cfgdsiv1 /odf/descriptors.c in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

Encode Django REST framework resource management error vulnerability

Encode Django REST framework versions prior to 3.18.2 contain a resource management error vulnerability. This vulnerability arises because JSONParser.parse uses the Content-Type charset value provided by the client to call codecs.getreader, accepting byte conversion and decoding encoders such as...

CVE-2025-60476

A heap use-after-free in the gfodfac4cfgcleanlist function /odf/descriptors.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

CVE-2025-60497

A segmentation violation in the GetESD function /isomedia/track.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

Red Hat: CVE-2026-96642: pillow: Pillow: Denial of Service via negative archive member size in TarIO

Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consum...

CVE-2025-60490

A heap use-after-free in the gffilterpidsendeventdownstream function /filtercore/filterpid.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

Red Hat: CVE-2026-96640: pillow: pillow: Denial of Service via duplicate page references in PDF files

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save..., format="PDF", append=True processes an attacker-controlled existing PDF whose...