EUVD-2026-49315

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

CVE-2026-58227 TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

CVE-2026-58227

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

CVE-2026-59251: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits in Erlang/OTP publickey certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy processing in publickey:pkixpathvalidation/3...

GHSA-6VCH-Q96H-7GC3 etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

Impact What kind of vulnerability is it? Who is impacted? A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake, and each is...

OESA-2026-3120 gnutls security update

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, and other...

OESA-2026-3121 gnutls security update

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, and other...

etcd: etcd: Denial of Service via unbounded TLS handshake goroutines

A flaw was found in etcd, a distributed key-value store. A remote attacker can exploit this by opening numerous TCP connections to an etcd TLS listener without completing the TLS handshake. This action causes the tlsListener.acceptLoop to spawn an unbounded number of goroutines, which consume...

PT-2026-71356

Name of the Vulnerable Software and Affected Versions etcd versions prior to 3.5.33 etcd versions prior to 3.6.14 etcd versions prior to 3.7.1 Description A network attacker capable of reaching an etcd TLS listener can initiate numerous TCP connections without sending a ClientHello. Within the fi...

GHSA-WC96-39FC-566F Netty: TOCTOU in OcspServerCertificateValidator

Summary Netty's OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client's downstream handlers to send sensitive application data e.g., HTTP requests to a revoked server before the channel is closed by the OC...

CVE-2026-13070

A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a...

AZL-92970 CVE-2026-50046 affecting package unbound for versions less than 1.25.2-1

In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS DoT forwarded queries is tied to a struct's 'servicedquery' lifetime but also referenced by another struct 'waitingtcp'. When the owning struct is jostled out of the mesh while the DoT TCP stream is...

unbound: Unbound: Denial of Service due to freed pointer dereference in DNS-over-TLS handling

A use-after-free flaw was found in Unbound's DNS-over-TLS DoT forwarded query handling. A remote attacker can exploit a timing error during TLS handshake failures on a server under load to trigger a daemon crash, resulting in a Denial of Service DoS...

CVE-2026-50046 Possible heap use-after-free in an error path when a DoT forwarded query is jostled out

In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS DoT forwarded queries is tied to a struct's 'servicedquery' lifetime but also referenced by another struct 'waitingtcp'. When the owning struct is jostled out of the mesh while the DoT TCP stream is...

CVE-2026-50046 Possible heap use-after-free in an error path when a DoT forwarded query is jostled out

In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS DoT forwarded queries is tied to a struct's 'servicedquery' lifetime but also referenced by another struct 'waitingtcp'. When the owning struct is jostled out of the mesh while the DoT TCP stream is...

CVE-2026-13070: NULL Pointer Dereference

A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a...

Improper Certificate Validation

Overview org.graalvm.sdk:graal-sdk is a high-performance JDK distribution designed to accelerate the execution of applications written in Java and other JVM languages along with support for JavaScript, Ruby, Python, and a number of other popular languages. Affected versions of this package are...

Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET TLS/SSL System.Net.Security. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service...

Medium: golang-github-cpuguy83-md2man

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

Amazon Linux 2023 : golang-github-burntsushi-toml, golang-github-burntsushi-toml-devel (ALAS2023-2026-1978)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1978 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...