PT-2026-51322

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.17 Mattermost versions 11.5.x through 11.5.5 Mattermost versions 11.6.x through 11.6.2 Mattermost versions 11.7.x through 11.7.0 Description An issue exists where the system fails to invalidate cached...

CVE-2026-9162: Insufficient Session Expiration

Mattermost versions 11.7.x = 11.7.0, 11.6.x = 11.6.2, 11.5.x = 11.5.5, 10.11.x = 10.11.17 fail to invalidate cached authentication state for active WebSocket connections during global session revocation, which allows a user with an existing WebSocket connection to remain authenticated and continu...

CVE-2026-56104: Missing Authorization

Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Attackers can exploit the...

Linux Distros Unpatched Vulnerability : CVE-2026-54274

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads,...

CVE-2026-54274: Allocation of Resources Without Limits or Throttling

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1...

[SECURITY] Fedora 43 Update: erlang-gun-2.4.1-1.fc43

Erlang HTTP client with support for HTTP/1.1, HTTP/2, Websocket and more...

[SECURITY] Fedora 44 Update: erlang-gun-2.4.1-1.fc44

Erlang HTTP client with support for HTTP/1.1, HTTP/2, Websocket and more...

SUSE-SU-2026:22197-1 Security update for tomcat10

This update for tomcat10 fixes the following issues Update to Tomcat 10.1.55: - CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling bsc1265162. - CVE-2026-41293: HTTP/2 request headers not validated bsc1265163. - CVE-2026-42498: WebSocket authentication header exposure bsc1265165....

SUSE-SU-2026:22195-1 Security update for tomcat

This update for tomcat fixes the following issues Update to Tomcat 9.0.118: - CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling bsc1265162. - CVE-2026-41293: HTTP/2 request headers not validated bsc1265163. - CVE-2026-42498: WebSocket authentication header exposure bsc1265165. -...

SUSE-SU-2026:22196-1 Security update for tomcat11

This update for tomcat11 fixes the following issues Update to Tomcat 11.0.22: - CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling bsc1265162. - CVE-2026-41293: HTTP/2 request headers not validated bsc1265163. - CVE-2026-42498: WebSocket authentication header exposure bsc1265165....

OPENSUSE-SU-2026:21121-1 Security update for tomcat11

This update for tomcat11 fixes the following issues Update to Tomcat 11.0.22: - CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling bsc1265162. - CVE-2026-41293: HTTP/2 request headers not validated bsc1265163. - CVE-2026-42498: WebSocket authentication header exposure bsc1265165....

Linux Distros Unpatched Vulnerability : CVE-2026-48779

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to but not including 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to...

Linux Distros Unpatched Vulnerability : CVE-2026-12151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of...

SUSE SLES12 Security Update : qemu (SUSE-SU-2026:2406-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2406-1 advisory. - CVE-2023-1544: pvrdma: out-of-bounds read in pvrdmaringnextelemread bsc1209554. - CVE-2025-11234: qemu-kvm: use-after-free in websocket...

Linux Distros Unpatched Vulnerability : CVE-2026-9675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious...

org.http4k:http4k-aws (3.153.0), org.http4k:http4k-client-apache (3.153.0) +31 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (3.153.0)

org.http4k:http4k-core MAVEN version 3.153.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.153.0 - org.http4k:http4k-client-apache 3.153.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.34.0), org.http4k:http4k-client-apache (3.34.0) +25 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (3.34.0)

org.http4k:http4k-core MAVEN version 3.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.34.0 - org.http4k:http4k-client-apache 3.34.0 - org.http4k:http4k-client-apache-async 3.34...

org.http4k:http4k-aws (3.10.0), org.http4k:http4k-client-apache (3.10.0) +21 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (3.10.0)

org.http4k:http4k-core MAVEN version 3.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.10.0 - org.http4k:http4k-client-apache 3.10.0 - org.http4k:http4k-client-okhttp 3.10.0 -...

org.http4k:http4k-aws (3.194.0), org.http4k:http4k-client-apache (3.194.0) +32 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (3.194.0)

org.http4k:http4k-core MAVEN version 3.194.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.194.0 - org.http4k:http4k-client-apache 3.194.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.11.1), org.http4k:http4k-client-apache (3.11.1) +23 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (3.11.1)

org.http4k:http4k-core MAVEN version 3.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.11.1 - org.http4k:http4k-client-apache 3.11.1 - org.http4k:http4k-client-apache-async 3.11...