29223 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-14457
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: In a server or client configuration with RFC7250 Raw Public Keys RPKs enabled, and only the private key with no associated certificate configured...
RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate
Issue summary: In a server or client configuration with RFC7250 Raw Public Keys RPKs enabled, and only the private key with no associated certificate configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted...
PT-2026-81392
X-AnyLabeling's model downloader disabled TLS certificate verification. download with retry in anylabeling/services/auto labeling/model.py built a context with ssl. create unverified context and passed it to urllib.request.urlopen, so neither the certificate chain nor the hostname was checked on...
java-1.7.0-openjdk: Fix of 11 CVEs
CVE-2024-20952: Enhance TLS connection support JDK-8317547, JDK-8302017 - CVE-2025-21587: Better TLS connection support JDK-8337692 - CVE-2026-34268: Enhance key generation JDK-8371935 - CVE-2026-22007: Enhance crypto algorithm support JDK-8369575 - CVE-2026-21925: Improve JMX connections...
CVE-2026-56684
A flaw was found in Valkey. An authenticated client can trigger a CLIENT KILL command while the tlsProcessPendingData function iterates a pending list. This action causes connTLSClose to delete the iterator's cached next node, leading to a use-after-free vulnerability. This flaw, when Transport...
CVE-2026-74611
A flaw was found in the Linux kernel's Transport Layer Security TLS 1.3 implementation. When processing TLS 1.3 records with optimistic zero-copy enabled, the tlsdecryptsg function fails to properly restore the message iterator during a retry. A remote attacker, by sending a specially crafted TLS...
JLSEC-2026-1377
Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mgtlsverifycertsan and mgtlsverifycertcn functions in...
JLSEC-2026-1376
Mongoose is an embedded web server and network library. Prior to 7.23, a network attacker can impersonate a TLS server to a Mongoose client configured with a multi-certificate CA bundle. In src/tlsbuiltin.c, the mgtlsinit function stores the bundle in tls-cabundleder while tls-cader.len remains...
CVE-2026-74610
A flaw was found in the Linux kernel's Transport Layer Security TLS implementation. An unprivileged local user could trigger a kernel null pointer dereference by sending specific data on a loopback TCP socket with the TLS Upper Layer Protocol ULP attached. This vulnerability occurs because the TL...
CVE-2026-78323
A flaw was found in JSS Java Security Services. The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTEDCA flags to be accepted as trust anchors for TLS connections. In non-default configurations...
CVE-2026-78323
A flaw was found in JSS Java Security Services. The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTEDCA flags to be accepted as trust anchors for TLS connections. In non-default configurations...
CVE-2026-78323
CVE-2026-78323 affects JSS (Java Security Services) , specifically the JSSTrustManager class, which fails to verify NSS trust flags when validating CA certificates. As a result, certificates stored in the NSS database without TRUSTED_CA flags can be accepted as trust anchors for TLS connections. ...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: The pin mechanism for the upper rpcclnt across the TLS-connected connectworker. The TLS connection process involves a use-after-free: Nothing pinning the upper rpcclnt occurs during the delayed connectworker. The xsconnec...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: sunrpc: When canceling a TLS handshake that is still in progress, there is a race condition where the callback for the ongoing handshake is not properly handled. When waitforcompletioninterruptibletimeout in svctcphandshake retur...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: The return value of nvmettcpsetqueuesock is currently ignored in nvmettcptlshandshakedone. If this function fails e.g., because the socket is not in the TCPESTABLISHED state, the socket callbacks will not be properly...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: sunrpc: pin svcxprt during the asynchronous TLS handshake callback svctcphandshake stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509. The handshake core only takes...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: net/tls: Empty data records are consumed in tlsswreadsock A peer may send a zero-length TLS applicationdata record; TLS 1.3 explicitly allows these as a traffic-analysis countermeasure RFC 8446, Section 5.1. After decryption, suc...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: tls: Fixed a NULL dereference issue in tlsswspliceeof, where an empty plaintext/ciphertext buffer could cause confusion in the sendfile process. When the plaintext/ciphertext skmsg is empty, the send path becomes confused because...
BIT-MASTODON-2026-59825 Mastodon: Unwanted deactivation of SSL/TLS certificate verification
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldapauthenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULTPARAMS when LDAP authentication uses LDAPTLSNOVERIFY=true, disabling SSL and T...
CVE-2026-70454
A flaw was found in the rsync-ssl wrapper script's TLS certificate validation. An on-path attacker can present self-signed or invalid certificates to intercept, decrypt, or tamper with encrypted sessions. Because rsync fails to validate the certificate against a trusted CA or verify hostname...