AlmaLinux 9.6 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1776855452)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776855452 advisory. - A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-complian...

Rocky Linux 9.6 [TuxCare] Security Update: haproxy (ALMALINUX9.6:CLSA-2026:1782725469)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782725469 advisory. - HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgiconn structure's drl field that...

CentOS Linux 7 [TuxCare] Security Update: libsoup / libsoup-devel (CENTOS7:CLSA-2025:1744892440)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1744892440 advisory. - GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored,...

Rocky Linux 9.6 [TuxCare] Security Update: libnghttp2 / libnghttp2-devel / nghttp2 (ALMALINUX9.6:CLSA-2026:1787308423)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787308423 advisory. - nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto...

AlmaLinux 9.6 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790759113)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790759113 advisory. - Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write. CVE-2026-94054 -...

CentOS Linux 6 [TuxCare] Security Update: haproxy (CENTOS6:CLSA-2026:1776337242)

The CentOS Linux 6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1776337242 advisory. - A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the chunked value were not bein...

AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.2:CLSA-2025:1738695770)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1738695770 advisory. - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from...

Rocky Linux 9.6 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc (ALMALINUX9.6:CLSA-2026:1787783675)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787783675 advisory. - A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accept...

AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786121727)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786121727 advisory. - Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred including exceeding limits during the...

CVE-2026-73256

A flaw was found in Mongoose. A remote, unauthenticated attacker can achieve unauthorized access or bypass security controls through HTTP request smuggling. Due to an error in protocol version validation, Mongoose fails to identify HTTP/1.0 requests and incorrectly processes chunked transfer...

CVE-2026-73257

A flaw was found in Mongoose. When processing incoming requests containing both Content-Length and Transfer-Encoding headers, the server accepts both headers instead of rejecting the malformed request. In environments where an upstream proxy processes request boundaries differently, a remote,...

Security update for netty, netty-tcnative

This update for netty, netty-tcnative fixes the following issues: CVE-2026-59902: Netty: Memory Exhaustion in SctpMessageCompletionHandler bsc1275501. CVE-2026-59903: Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite bsc1275500. CVE-2026-62243: TLS...

SUSE-SU-2026:4391-1 Security update for netty, netty-tcnative

This update for netty, netty-tcnative fixes the following issues: - CVE-2026-59902: Netty: Memory Exhaustion in SctpMessageCompletionHandler bsc1275501. - CVE-2026-59903: Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite bsc1275500. - CVE-2026-62243: TL...

CVE-2026-77756

A flaw was found in Apache Tomcat. This vulnerability, known as HTTP Request/Response Smuggling, occurs when Tomcat processes the transfer-encoding header for an HTTP/1.0 request while operating behind a reverse proxy. A remote attacker could exploit this to cause a denial of service, leading to...

Citrix NetScaler CVE-2026-88773 Detect

Detects Citrix NetScaler ADC/Gateway builds likely affected by CVE-2026-88773 HTTP request/response smuggling, CWE-444. Confirms NetScaler presence and parses appliance firmware against CTX697096 fixed builds 14.1-73.37+, 13.1-64.23+. Does not send smuggling probes. !/usr/bin/env python3 -- codin...

Security Bulletin: IBM Watson Explorer is affected by a vulnerability in IBM WebSphere Application Server Liberty

Summary IBM Watson Explorer contains a vulnerable version of IBM WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2026-14981 DESCRIPTION: IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the...

Security Bulletin: IBM Watson Explorer is affected by a vulnerability in IBM WebSphere Application Server Liberty (CVE-2026-11541)

Summary IBM Watson Explorer contains a vulnerable version of IBM WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2026-11541 DESCRIPTION: IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Exim vulnerabilities (USN-8834-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8834-1 advisory. It was discovered that Exim had an out-of-bounds write when Proxy-Protocol was used with an attacker- controlled proxy. A remote...

Important: squid

Issue Overview: Due to a CWE-841 Improper Enforcement of Behavioral Workflow bug Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used. Bypassing security...

PT-2026-102726

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete...