Security Bulletin: Security vulnerability in IBM WebSphere Application Server Liberty affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak

Summary A security vulnerability in IBM WebSphere Application Server Liberty affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak. IBM WebSphere Application Server Liberty is used by IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak...

Security Bulletin: IBM App Connect Enterprise is affected by multiple vulnerabilities in Eclipse Jetty (CVE-2026-8384 and CVE-2026-19203)

Summary IBM App Connect Enterprise Toolkit is affected by multiple vulnerabilities in Eclipse Jetty. Vulnerability Details CVEID:CVE-2026-8384 DESCRIPTION: In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instea...

CLEANSTART-2026-IE55797 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards req...

Security vulnerability affects the apache2 package. Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in modproxyajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to...

CLEANSTART-2026-VL60700 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards req...

Security vulnerability affects the apache2 package. Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in modproxyajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to...

CLEANSTART-2026-CY90357 HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi

Security vulnerability affects the apache2 package. HTTP Response Smuggling vulnerability in Apache HTTP Server via modproxyuwsgi...

CLEANSTART-2026-AY85890 discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary

Security vulnerability affects the victoria-metrics package. A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary...

EUVD-2026-95428

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

Linux Distros Unpatched Vulnerability : CVE-2026-94439

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to...

Progress Telerik Fiddler Classic < 6.0.20262.10021 Multiple Vulnerabilities

The version of Progress Telerik Fiddler Classic installed on the remote Windows host is prior to 6.0.20262.10021. It is, therefore, affected by multiple vulnerabilities: - An insufficient integrity check on external helper tools allows a local low-privileged attacker to replace a helper executabl...

CVE-2026-94439

A flaw was found in Go's net/http package. When an HTTP server sends a successful response to an HTTP/1 CONNECT request without taking raw control of the connection, it improperly continues to process incoming data as standard HTTP requests instead of establishing a tunnel. A remote attacker can...

AZL-108222 CVE-2026-94439 affecting package golang 1.26.7-1

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

DEBIAN-CVE-2026-94439

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

AZL-108468 CVE-2026-94439 affecting package python-tensorboard 2.16.2-6

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

AZL-108543 CVE-2026-94439 affecting package tensorflow 2.16.1-11

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

AZL-108239 CVE-2026-94439 affecting package golang 1.27.1-1

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

CVE-2026-94439

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

AZL-107177 CVE-2026-78660 affecting package azurelinux-image-tools 1.6.0-3

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

AZL-108213 CVE-2026-78660 affecting package golang 1.26.7-1

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

AZL-107901 CVE-2026-78660 affecting package sriov-network-device-plugin 3.7.0-8

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

AZL-107357 CVE-2026-78660 affecting package docker-compose 2.27.0-14

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...