SUSE-SU-2026:3321-1 Security update for the Linux Kernel (Live Patch 3 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.11 fixes various security issues: The following security issues were fixed: - CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. - CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060. ...

SUSE-SU-2026:3316-1 Security update for the Linux Kernel (Live Patch 5 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.19 fixes various security issues: The following security issues were fixed: - CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. - CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060. ...

SUSE CVE-2025-59353

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, a peer can obtain a valid TLS certificate for arbitrary IP addresses, effectively rendering the mTLS authentication useless. The issue is that the Manager's Certificate gRPC service does not...

DEBIAN-CVE-2026-58227

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

UBUNTU-CVE-2026-55953

The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...

EUVD-2026-49325

Allocation of resources without limits in Erlang/OTP publickey certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy processing in publickey:pkixpathvalidation/3...

CVE-2026-59251 Denial of service via exponential certificate policy tree growth in path validation

Allocation of resources without limits in Erlang/OTP publickey certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy processing in publickey:pkixpathvalidation/3...

CVE-2026-55953

The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...

CVE-2026-55953 TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication

The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...

CVE-2026-55953 TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication

The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...

CVE-2026-58227 TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues Upgrade to upstream tag jdk-11.0.32+9 July 2026 CPU. Security issues fixed: CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. CVE-2026-46917: unauthenticated attacker with...

SUSE-SU-2026:3284-1 Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues Upgrade to upstream tag jdk-11.0.32+9 July 2026 CPU. Security issues fixed: - CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: unauthenticated attacker with...

Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.34 fixes various security issues: The following security issues were fixed: CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060...

CVE-2026-48144

Apache Thrift c_glib bindings are affected by an improper validation of certificate hostnames (host mismatch) leading to a potential TLS trust issue. The issue affects Thrift before 0.24.0 and is rated CRITICAL (CVSS 4.0: AV:N/AC:H/PR:N/UI:N/S:S/VC:H/VI:H/VA:N) with high impact on confidentiality...

Erlang/OTP -- (D)TLS-1.2 server certificate verification bypass

https://github.com/erlang/otp/security/advisories/GHSA-c6cw-pr89-w882 reports: The OTP TLS/DTLS client pre TLS-1.3 does not verify that the cipher suite selected by the server in ServerHello is one of those offered in ClientHello. A man-in-the-middle attacker can select an anonymous cipher suite...

Erlang/OTP -- TLS denial of service using invalid certificate chains

https://github.com/erlang/otp/security/advisories/GHSA-r5jr-mq46-vmhw reports: A TLS/DTLS peer can crash the remote node by sending a certificate chain containing two mutually cross-signed certificates in unordered form. When the receiving side attempts to build a valid chain path, it enters...

SUSE-SU-2026:3254-1 Security update for the Linux Kernel (Live Patch 25 for SUSE Linux Enterprise 15 SP6)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.109 fixes various security issues: The following security issues were fixed: - CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. - CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060....

SUSE-SU-2026:3246-1 Security update for the Linux Kernel RT (Live Patch 14 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.51 fixes various security issues: The following security issues were fixed: - CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. - CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060. -...

[SECURITY] Fedora 43 Update: mbedtls-3.6.7-1.fc43

Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible...