AlmaLinux 9.2 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1790076145)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790076145 advisory. - A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression...

Rocky Linux 9 [CIQ] Security Update: libsoup / libsoup-debuginfo / libsoup-debugsource / libsoup-devel Multiple Vulnerabilities (crlsa-2026_68234)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202668234 advisory. SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service CVE-2026-15709 libsoup:...

Rocky Linux 9.6 [TuxCare] Security Update: qemu-guest-agent / qemu-img / qemu-kvm / qemu-kvm-audio-dbus / etc (ALMALINUX9.6:CLSA-2026:1779581056)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779581056 advisory. - A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This...

Rocky Linux 9 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2024_3307)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243307 advisory. Apache Tomcat: HTTP/2 header handling DoS CVE-2024-24549 Apache Tomcat: WebSocket DoS with incomplete closing handshake CVE-2024-23672 Bug Fixes and...

Rocky Linux 10.1 [CIQ] Security Update: qemu-guest-agent / qemu-guest-agent-debuginfo / qemu-img / etc (crlsa-2026_1831)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20261831 advisory. qemu-kvm: VNC WebSocket handshake use-after-free CVE-2025-11234 Tenable has extracted the preceding description block directly from the CIQ security advisory. No...

Rocky Linux 9 [CIQ] Security Update: qemu-guest-agent / qemu-guest-agent-debuginfo / qemu-img / etc (crlsa-2026_18772)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202618772 advisory. qemu-kvm: VNC WebSocket handshake use-after-free CVE-2025-11234 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-8.0 / aspnetcore-targeting-pack-8.0 / dotnet / etc (crlsa-2024_1311)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20241311 advisory. dotnet: DoS in .NET Core / YARP HTTP / 2 WebSocket support CVE-2024-21392 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-7.0 / aspnetcore-targeting-pack-7.0 / etc (crlsa-2024_1308)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20241308 advisory. dotnet: DoS in .NET Core / YARP HTTP / 2 WebSocket support CVE-2024-21392 Tenable has extracted the preceding description block directly from the CIQ security...

PT-2026-104004

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description WebSocket endpoints lack proper authentication mechanisms, which allows attackers to impersonate charging stations. This flaw enables unauthorized access to...

undici: undici: Denial of Service via unrequested WebSocket subprotocol

A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service DoS...

CVE-2026-51856

In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes executepythoncode as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment. In the validated path, RealtimeAgent.acting forwards the...

CVE-2026-101881

OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause...

ROOT-APP-MAVEN-CVE-2025-41254 CVE-2025-41254 in org.springframework:spring-websocket - Patched by Root

Root has patched CVE-2025-41254 in the org.springframework:spring-websocket package for Root:Maven. Multiple fixed versions available...

CVE-2026-101881 OpenClaw Windows Node before 2026.7.1 Denial of Service

OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause...

CVE-2026-101881 OpenClaw Windows Node before 2026.7.1 Denial of Service

OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause...

EUVD-2026-90254

OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause...

CVE-2026-101881 OpenClaw Windows Node before 2026.7.1 Denial of Service

OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause...

CVE-2026-101881

The OpenClaw Windows Node software, specifically versions before 2026.7.1 , is vulnerable to a Denial of Service (DoS) condition. The root cause is an allocation of resources without limits within the gateway WebSocket transport . An attacker can exploit this by sending an unending sequence of We...

CVE-2026-103472

restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. Remote unauthenticated attackers can declare large frame sizes and stream payload data to exhaust server memory, causing denial ...

SUSE-SU-2026:23985-1 Security update for libtcnative-1-0, libtcnative-2-0, tomcat, tomcat10, tomcat11

This update for libtcnative-1-0, libtcnative-2-0, tomcat, tomcat10, tomcat11 fixes the following issues: Security issues fixed: - CVE-2026-73581: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore bsc1282631. - CVE-2026-75973: improper authentication when...