8769 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-102559
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation AP...
Important: nodejs22
Issue Overview: undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protoc...
SUSE CVE-2026-67411
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted PROXY Protocol frontend could lose the proxy-derived client address before the MQTT authentication path checked loopbackusers, causing th...
GHSA-3WWX-PV8P-Q78V undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
Impact undici's WebSocket client including Node.js's bundled globalThis.WebSocket crashes the entire Node.js process when a remote WebSocket peer sends a permessage-deflate compressed message that crosses the decompressed-payload size limit and then contains a malformed DEFLATE block. In...
EUVD-2026-71603
undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression...
undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
Impact undici's WebSocket client including Node.js's bundled globalThis.WebSocket crashes the entire Node.js process when a remote WebSocket peer sends a permessage-deflate compressed message that crosses the decompressed-payload size limit and then contains a malformed DEFLATE block. In...
NPM: undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
NPM: undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression vulnerability discovered by ? in WordPress Npm undici versions = 6.25.0, 6.28.1...
GO-2026-6482 Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation in github.com/mattermost/mattermost-server
Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation in github.com/mattermost/mattermost-server...
K000163436: Apache Tomcat vulnerabilities CVE-2026-73581, CVE-2026-76183, CVE-2026-77762, and CVE-2026-79677
Security Advisory Description CVE-2026-73581 Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M...
CVE-2026-87022
A flaw was found in Apache Tomcat. This vulnerability, related to improper handling of length parameters, allows for WebSocket message smuggling when the 'per-message-deflate' extension is in use. A remote attacker could exploit this to bypass security controls or inject malicious data into...
CVE-2026-79677
A flaw was found in Apache Tomcat. This vulnerability allows a remote attacker to cause a Denial of Service DoS by exploiting lost timeouts for asynchronous WebSocket writes. This can lead to the affected system becoming unresponsive or unavailable...
CVE-2026-77791
A flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability occurs when sending a WebSocket close message, which can lead to a busy wait condition. A remote attacker could exploit this to cause a Denial of Service DoS by making the server unresponsive. Mitigation Red Hat...
CVE-2026-76183
A flaw was found in Apache Tomcat. This vulnerability, known as an 'Authentication Bypass by Alternate Name', allows an attacker to bypass the security restrictions set for WebSocket endpoints. This means that unauthorized users could gain access to protected resources or functionality, potential...
Uncontrolled Resource Consumption
Apache Tomcat is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to improper resource management in the WebSocket chat example application, which allows an attacker to consume excessive server resources and potentially cause a denial-of-service condition...
CVE-2026-82932 Missing Firewall Configuration in mH-DEVELOPER
mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service. This issue was fixed in...
CVE-2026-82930
The mH-DEVELOPER smart home module contains a vulnerability where the authorization middleware fails to verify tokens. This flaw leaves all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can exploit this to query endpoints, access system...
CVE-2026-82930 Missing Authentication in mH-DEVELOPER
mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to...
CVE-2026-82930 Missing Authentication in mH-DEVELOPER
mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to...