python-urllib3 security update

1.26.19-4.2 - CVE-2026-97689 python3.12-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser Resolves: RHEL-282258 1.26.19-4.1 - CVE-2026-97687 python3.12-urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override HTTPS proxy TLS configuration...

ALSA-2026:85930 Important: python-urllib3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

grafana: grafana: Denial of Service via unbounded request body size in Prometheus rule conversion API

A flaw was found in Grafana. The Prometheus rule conversion API endpoints fail to enforce a limit on request body sizes. An authenticated user can exploit this vulnerability by submitting excessively large requests to trigger unbounded memory allocation, which crashes the server and results in a...

CVE-2026-112214

A vulnerability exists in the GStreamer ASF demuxer within the gst-plugins-ugly component. The flaw occurs when parsing a Simple Index object , where an attacker-controlled entry count is used to determine the size of a heap allocation without being restricted to the actual payload size. Processi...

CVE-2026-112214 Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser

A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very lar...

CVE-2026-112214 Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser

A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very lar...

Important: python3.14-urllib3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

python3.14-urllib3 security update

2.6.3-6 - Fix a regression with Python 3.14.8 2.6.3-5 - Fix teststartclosedsocket with latest Python 2.6.3-4 - CVE-2026-97689 python3.14-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser 2.6.3-3 - CVE-2026-97687 python3.14-urllib3: urllib3: Traffic interception v...

python3.14-urllib3 security update

2.6.3-6 - Fix a regression with Python 3.14.8 2.6.3-5 - Fix teststartclosedsocket with latest Python 2.6.3-4 - CVE-2026-97689 python3.14-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser 2.6.3-3 - CVE-2026-97687 python3.14-urllib3: urllib3: Traffic interception v...

grafana: grafana: Denial of Service via unbounded request body size in Prometheus rule conversion API

A flaw was found in Grafana. The Prometheus rule conversion API endpoints fail to enforce a limit on request body sizes. An authenticated user can exploit this vulnerability by submitting excessively large requests to trigger unbounded memory allocation, which crashes the server and results in a...

CVE-2026-85231

A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC Remote Procedure Call service configured with RPCSECGSS Remote Procedure Call Security-Generic Security Service integrity or privacy. This can lead ...

CVE-2026-85231

A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC Remote Procedure Call service configured with RPCSECGSS Remote Procedure Call Security-Generic Security Service integrity or privacy. This can lead ...

EUVD-2026-103019

A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC Remote Procedure Call service configured with RPCSECGSS Remote Procedure Call Security-Generic Security Service integrity or privacy. This can lead ...

CVE-2026-85231

A flaw in libtirpc allows an authenticated remote attacker to trigger a Denial of Service (DoS) by sending oversized wrapped data requests to an RPC service configured with RPCSEC_GSS integrity or privacy. The root cause is unbounded memory allocation during rpcsec_gss decoding, which can exhaust...

CVE-2026-85231 Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding

A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC Remote Procedure Call service configured with RPCSECGSS Remote Procedure Call Security-Generic Security Service integrity or privacy. This can lead ...

CVE-2026-85231

A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC Remote Procedure Call service configured with RPCSECGSS Remote Procedure Call Security-Generic Security Service integrity or privacy. This can lead ...

rpcbind security update

An update is available for rpcbind. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The rpcbind utility is a server that converts Remote Procedure Call RPC progr...

rpcbind security update

An update is available for rpcbind. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The rpcbind utility is a server that converts Remote Procedure Call RPC progr...

PT-2026-116130

Name of the Vulnerable Software and Affected Versions libtirpc affected versions not specified Description An authenticated remote attacker can cause a Denial of Service DoS by sending oversized wrapped data requests to an RPC Remote Procedure Call service configured with RPCSEC GSS Remote...

CVE-2026-111279 Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER

Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to...