CVE-2026-84783: Use After Free

Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. Impact summary: A remote, unauthenticated peer could crash a multi-threaded TLS client, or a multi-threaded TLS server...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Erlang vulnerabilities (USN-8827-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8827-1 advisory. It was discovered that the Erlang Port Mapper Daemon did not properly handle slow...

RHEL 10 : java-21-ibm-semeru-certified-jdk (RHSA-2026:72888)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72888 advisory. The IBM Semeru Runtime Certified Edition 21 runtime environment. Security Fixes: OpenJDK: Improve Resource Resolving 2026-08 Security Upda...

FreeBSD -- Remote DoS via receive-side kernel TLS

Problem Description: TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followe...

CVE-2026-72897: Out-of-bounds Write

Issue summary: A TLS server that calls SSLsetSSLCTX to switch a connection to a different SSLCTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created...

CVE-2026-102728: Buffer Over-read

Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a...

Linux Distros Unpatched Vulnerability : CVE-2026-84783

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is...

PT-2026-102653

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description A TLS server may experience an out-of-bounds read and a fixed-value out-of-bounds write on the server heap when calling the SSL set SSL CTX function to switch a connection to a different SSL...

Linux Distros Unpatched Vulnerability : CVE-2026-72897

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: A TLS server that calls SSLsetSSLCTX to switch a connection to a different SSLCTX part way through a handshake may access memory beyond the end o...

Amazon Linux 2 : nginx (ALASNGINX1-2026-016)

The version of nginx installed on the remote host is prior to 1.30.5-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NGINX1-2026-016 advisory. NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with OpenSSL versions =...

ALSA-2026:73428 Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

RHEL 10 : nodejs24 (RHSA-2026:73428)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73428 advisory. Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an...

SUSE CVE-2026-91767

phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP...

Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure

Summary Nodemailer's process-global DNS cache is keyed only by host, but each cache entry also stores the caller-specific TLS servername. When two direct SMTPS transports use the same DNS host with different tls.servername values, the first transport's server name is returned to the second...

GHSA-6VJ9-MWQ6-2F5V Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure

Summary Nodemailer's process-global DNS cache is keyed only by host, but each cache entry also stores the caller-specific TLS servername. When two direct SMTPS transports use the same DNS host with different tls.servername values, the first transport's server name is returned to the second...

Improper Certificate Validation

Overview @grpc/grpc-js is a gRPC Library for Node Affected versions of this package are vulnerable to Improper Certificate Validation via getAuthContext in server-interceptors.ts and the TLS session handling in transport.ts, where the authorized property of a TLS socket is not checked before...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

Important: Red Hat Security Advisory: git-lfs security update

An update for git-lfs is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabili...

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...