CVE-2026-42544

CVE-2026-42544 (Granian) affects Granian versions 1.2.0–2.7.4, where an unauthenticated client sending a WebSocket upgrade request with a non-ASCII Sec-WebSocket-Protocol header causes the server to abort the worker in the WebSocket scope construction path, yielding an unauthenticated DoS. The cr...

CVE-2026-42544

Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction...

CVE-2026-42544 Granian: Unauthenticated DoS via WebSocket subprotocol header panic

Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction...

tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.

A flaw was found in Apache Tomcat. During WebSocket authentication, the HTTP Authentication Header can be exposed to unexpected hosts. This vulnerability leads to information disclosure, potentially allowing an attacker to gain access to sensitive authentication credentials...

CVE-2026-42889

Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full...

CVE-2026-42889

Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full...

CVE-2026-42889 Relay Server WebSocket authentication bypass when token is omitted

Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full...

CVE-2026-42889

Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full...

EUVD-2026-29792

Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full...

CVE-2026-42889

Summary (CVE-2026-42889): Relay Server (used with Obsidian) versions 0.9.0–0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were treated as having full server permissions, all...

CVE-2026-42889 Relay Server WebSocket authentication bypass when token is omitted

Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full...

net.unit8.waitt.server:waitt-tomcat7 (1.2.0), org.akhikhl.gretty:gretty-runner-tomcat (2.0.0) +3 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (7.0.78)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.78 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - net.unit8.waitt.server:waitt-tomcat7 1.2.0 -...

net.oneandone.troilus:troilus-service-example (>=0.5, <=0.6), net.oneandone:troilus-service-example (>=0.2, <=0.4) +5 more potentially affected by CVE-2026-43512 via org.apache.tomcat.embed:tomcat-embed-core (8.0.12)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - net.oneandone.troilus:troilus-service-example =0.5, =0.2, =0.4 -...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.104), org.apache.tomcat.embed:tomcat-embed-websocket (7.0.104) +1 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (7.0.104)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.104 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.104 -...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.99), org.apache.tomcat.embed:tomcat-embed-websocket (7.0.99) +1 more potentially affected by CVE-2026-42498 via org.apache.tomcat.embed:tomcat-embed-core (7.0.99)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.99 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.99 -...

io.gitee.sylarsylar:maplex (>=1.0, <=5.5.12), org.apache.tomcat.embed:tomcat-embed-jasper (8.5.88) +2 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (8.5.88)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.88 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - io.gitee.sylarsylar:maplex =1.0, =3.21.0, =3.23.5 Source cves: CVE-2026-4351...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.92), org.apache.tomcat.embed:tomcat-embed-websocket (7.0.92) potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (7.0.92)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.92 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.92 -...

com.github.jsimone:webapp-runner (8.0.52.0), com.linecorp.armeria:armeria-tomcat8.0 (>=0.64.0, <=0.67.1) +4 more potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (8.0.52)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.52 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.github.jsimone:webapp-runner 8.0.52.0 -...

com.github.psi-probe:psi-probe-tomcat7 (3.5.3), com.github.waffle:waffle-tomcat7 (3.0.0) +7 more potentially affected by CVE-2026-42498 via org.apache.tomcat:tomcat-catalina (7.0.107)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.107 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.github.psi-probe:psi-probe-tomcat7 3.5.3 - com.github.waffle:waffle-tomcat7 3.0.0 -...

com.51degrees:geo-location.web.examples.mvc (>=4.4.14, <=4.4.16), com.51degrees:geo-location.web.examples.servlet (>=4.4.14, <=4.4.16) +3 more potentially affected by CVE-2026-42498 via org.apache.tomcat.embed:tomcat-embed-core (8.5.91)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.91 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.51degrees:geo-location.web.examples.mvc =4.4.14, =4.4.14, =4.4.14, =4.4....