CVE-2026-91865

A flaw was found in Apache Neethi. A remote attacker could exploit this vulnerability by providing a specially crafted WS-Policy document containing repeated policy references. This document would force Neethi to exponentially re-expand the same references during normalization, consuming excessiv...

CVE-2026-91864

A flaw was found in Apache Neethi. A remote attacker could exploit this vulnerability by sending a specially crafted WS-Policy document. This document can contain unlimited content within a policy assertion, which Neethi processes without proper size limits. This can lead to memory exhaustion,...

CVE-2026-91863

A flaw was found in Apache Neethi. A remote attacker could exploit this vulnerability by sending a specially crafted WS-Policy document containing deeply nested policy elements. This crafted document can bypass the parser's nesting-depth limit, leading to uncontrolled recursion that exhausts the...

CLSA-2026-1790174669 TuxCare security update for ws (2 CVEs)

TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.2.3-tuxcare.1...

CLSA-2026-1790164156 TuxCare security update for ws (2 CVEs)

TuxCare rebuilt ws to address 2 CVEs. Fixed in 6.2.2-tuxcare.1...

CLSA-2026-1790164081 TuxCare security update for ws (2 CVEs)

TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.5.0-tuxcare.1...

CLSA-2026-1790161463 TuxCare security update for ws (2 CVEs)

TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.11.0-tuxcare.1...

CLSA-2026-1790161419 TuxCare security update for ws (1 CVE)

TuxCare rebuilt ws to address 1 CVE. Fixed in 6.2.3-tuxcare.1...

Malicious code in turbo-ws (npm)

Source: amazon-inspector a25d8c29cbfb317e1c88568514a999618bdeee25b2716b76e3db5062e9dd7a67 package.json at line 43 declares the sole dependency 'node-net-pool' as an HTTPS tarball of the 'main' branch of an unrelated GitHub account...

MAL-2026-16440 Malicious code in turbo-ws (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a25d8c29cbfb317e1c88568514a999618bdeee25b2716b76e3db5062e9dd7a67 package.json at line 43 declares the sole dependency 'node-net-pool' as an HTTPS tarball of the 'main' branch of an unrelated GitHub account...

Malicious code in turbo-ws (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a25d8c29cbfb317e1c88568514a999618bdeee25b2716b76e3db5062e9dd7a67 package.json at line 43 declares the sole dependency 'node-net-pool' as an HTTPS tarball of the 'main' branch of an unrelated GitHub account...

PT-2026-105384

TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.11.0-tuxcare.1...

PT-2026-105382

TuxCare rebuilt ws to address 1 CVE. Fixed in 6.2.3-tuxcare.1...

PT-2026-105400

TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.2.3-tuxcare.1...

PT-2026-105428

TuxCare rebuilt ws to address 1 CVE. Fixed in 8.11.0-tuxcare.2...

PT-2026-105392

TuxCare rebuilt ws to address 2 CVEs. Fixed in 6.2.2-tuxcare.1...

PT-2026-105434

TuxCare rebuilt ws to address 1 CVE. Fixed in 8.5.0-tuxcare.2...

PT-2026-105391

TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.5.0-tuxcare.1...

aiorest-ws (>=1.1.0, <=1.1.1) potentially affected by CVE-2026-77528 via autobahn (0.16.0)

autobahn PYPI version 0.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - aiorest-ws =1.1.0, =1.1.1 Source cves: CVE-2026-77528 Source advisory: OSV:GHSA-HXP9-W8X3-P566...

CVE-2026-77322

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transportws.go creates a wsutil.Reader without setting MaxFrameSize, allowing NextFrame to accept a client-controlled header.Length before ParseMaxMessageLength is applied. An unauthenticated ...