nodejs: Nodejs denial of service

A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when pskCallback or ALPNCallback are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths tlsClientError and error, causing either immediate...

Oracle Linux 9 : nginx:1.26 (ELSA-2026-7343)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-7343 advisory. - Resolves: RHEL-157887 - CVE-2026-32647 nginx:1.26/nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files - Resolves:...

MGASA-2026-0095 Updated tomcat packages fix security vulnerabilities

Request smuggling via invalid chunk extension. CVE-2026-24880 Occasionally open redirect. CVE-2026-25854 TLS cipher order is not preserved. CVE-2026-29129 OCSP checks sometimes soft-fail even when soft-fail is disabled. CVE-2026-29145 EncryptInterceptor vulnerable to padding oracle attack by...

OESA-2026-1864 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to detect potential corrupted nid in freenidlist As reported, on-disk footer.ino and footer.nid is the same and out-of-range, let's add sanity check on...

OESA-2026-1862 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to detect potential corrupted nid in freenidlist As reported, on-disk footer.ino and footer.nid is the same and out-of-range, let's add sanity check on...

CVE-2026-32280 vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.12-sdk, kubernetes, helm-fips, kustomize-fips, cert-manager-google-cas-issuer, neuvector-scanner-fips, rancher-fleet, crossplane-function-go-templating-fips, metrics-agent-fips, minio-fips, crossplane-provider-aws-lambda-fips,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: kustomize-fips, kubernetes, helm-fips, cert-manager-google-cas-issuer, neuvector-scanner-fips, rancher-fleet, crossplane-function-go-templating-fips, metrics-agent-fips, minio-fips, crossplane-provider-aws-lambda-fips, rancher-system-upgrade-controller,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.12-sdk, kubernetes, helm-fips, kustomize-fips, cert-manager-google-cas-issuer, neuvector-scanner-fips, rancher-fleet, crossplane-function-go-templating-fips, metrics-agent-fips, minio-fips, crossplane-provider-aws-lambda-fips,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: minio-fips, crossplane-provider-aws-lambda-fips, kubescape-operator-fips, xcaddy, knative-serving, nri-apache, crossplane-provider-aws-iam-fips, crossplane-provider-aws-cloudfront-fips, ip-masq-agent, litmus-chaos-operator-fips, qemu-guesthelper,...

GHSA-GJVH-7JH8-7XHM vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.12-sdk, kubernetes, helm-fips, kustomize-fips, cert-manager-google-cas-issuer, neuvector-scanner-fips, rancher-fleet, crossplane-function-go-templating-fips, metrics-agent-fips, minio-fips, crossplane-provider-aws-lambda-fips,...

nginx:1.26 security update

2:1.26.3-2.0.1.1 - Require oracle-indexhtml 2:1.26.3-6 - Resolves: RHEL-157887 - CVE-2026-32647 nginx:1.26/nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files 2:1.26.3-5 - Resolves: RHEL-159446 - CVE-2026-27651 nginx:1.26/nginx: NGINX: Denial of Service via undisclos...

FreeBSD : Mbed TLS -- vulnerabilities (d77bd2f5-34f0-11f1-bc6d-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the d77bd2f5-34f0-11f1-bc6d-3c7c3fba4204 advisory. https://mbed-tls.readthedocs.io/en/latest/security-advisories/ reports: Tenable has extracted...

gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification

A flaw was found in GnuTLS. This vulnerability allows a denial of service DoS by excessive CPU Central Processing Unit and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names SANs...

gnutls: gnutls: Remote Denial of Service via crafted ClientHello with invalid PSK binder

A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello message with an invalid Pre-Shared Key PSK binder value during the TLS handshake. This can lead to a NULL pointer dereference, causing the server to crash and...

GHSA-445C-VH5M-36RJ Apache Log4j Core: log injection in `Rfc5424Layout` due to silent configuration incompatibility

Apache Log4j Core's Rfc5424Layout, in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes. Two distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:...

GHSA-6HG6-V5C8-FPHQ Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration

The fix for CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName attribute of the element. Although the verifyHostName configuration attribute was introduced in Log4...

EUVD-2026-21407

The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.htmllog4j2.sslVerifyHostName system property, but no...

Improper Validation of Certificate with Host Mismatch

Overview org.apache.logging.log4j:log4j-core is a logging library for Java. Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch due to the lack of TLS hostname verification in the SocketAppender component when configured through the...

CVE-2026-34478

Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.htmlRFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes. Two distinct issues affect user...

CVE-2026-34477

The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.htmllog4j2.sslVerifyHostName system property, but no...