Rocky Linux 8 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux Multiple Vulnerabilities (crlsa-2026_62407)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202662407 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via...

openssl: openssl: Denial of Service via out-of-bounds write during TLS context switch

A flaw was found in openssl. When a server replaces its security context during an active Transport Layer Security TLS handshake, it fails to update the internal capacity tracking for cryptographic signature algorithms. A remote peer can exploit this issue by advertising specific signature...

openssl: openssl: Denial of Service via excessive memory allocation in CRL distribution point processing

A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service DoS by presenting a specially crafted certificate during a Transport Layer Security TLS handshake. When OpenSSL processes and caches certificate extensions containing numerous Certificate Revocation List CRL distribution...

openssl: openssl: Denial of Service via excessive memory allocation in CRL distribution point processing

A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service DoS by presenting a specially crafted certificate during a Transport Layer Security TLS handshake. When OpenSSL processes and caches certificate extensions containing numerous Certificate Revocation List CRL distribution...

openssl: openssl: Denial of Service via out-of-bounds write during TLS context switch

A flaw was found in openssl. When a server replaces its security context during an active Transport Layer Security TLS handshake, it fails to update the internal capacity tracking for cryptographic signature algorithms. A remote peer can exploit this issue by advertising specific signature...

Important: Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

An update for the nodejs:24 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options

A flaw was found in undici's BalancedPool component. This vulnerability allows a remote attacker to bypass Transport Layer Security TLS certificate validation. The BalancedPool constructor incorrectly processes its options, silently discarding custom certificate validation functions. Consequently...

DEBIAN-CVE-2026-19445

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...

AZL-105690 CVE-2026-19445 affecting package python3 3.12.14-2

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...

ALPINE-CVE-2026-19445

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...

CVE-2026-19445 Use-after-free of a server-side SSLContext when sni_callback switches contexts

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...

CVE-2026-19445

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...

CVE-2026-19445

A remote, unauthenticated TLS client can trigger a server crash or a use-after-free (calling through a freed pointer) vulnerability. This occurs when the sni_callback assigns a different context to SSLSocket.context —the standard method for selecting certificates per server name—without any other...

CVE-2026-19445

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...

OpenSSL_1_0_1g_CVE-2015-1788

OpenSSL 1.0.1g 7 Apr 2014 Copyright c 1998-2011 The OpenSSL Project Copyright c 1995-1998 Eric A. Young, Tim J. Hudson All rights reserved. DESCRIPTION The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, fully featured, and Open Source toolkit implementing the...

Improper Certificate Validation

Snowflake drivers are vulnerable to Improper Certificate Validation. The vulnerability is due to improper validation of OCSP responses and treating definitive verification failures as transient, which allows a man-in-the-middle attacker with a revoked certificate and its private key to establish ...

GHSA-8988-9CW3-XX77 urllib3: HTTPS proxy TLS configuration may be ignored or overridden

Impact urllib3 supports configuring TLS independently for an HTTPS proxy and the target server. proxysslcontext, proxyasserthostname, and proxyassertfingerprint configure the TLS connection to the proxy. sslcontext and the other target-specific TLS parameters configure the connection to the targe...

urllib3: HTTPS proxy TLS configuration may be ignored or overridden

Impact urllib3 supports configuring TLS independently for an HTTPS proxy and the target server. proxysslcontext, proxyasserthostname, and proxyassertfingerprint configure the TLS connection to the proxy. sslcontext and the other target-specific TLS parameters configure the connection to the targe...

EUVD-2026-89000

urllib3: HTTPS proxy TLS configuration may be ignored or overridden...

OESA-2026-4137 jss security update

Java Security Services JSS is a java native interface which provides a bridge for java-based applications to use native Network Security Services NSS. This only works with gcj. Other JREs require that JCE providers be signed. Security Fixes: A flaw was found in JSS Java Security Services. The...