SUSE-SU-2026:2406-1 Security update for qemu

This update for qemu fixes the following issues: - CVE-2023-1544: pvrdma: out-of-bounds read in pvrdmaringnextelemread bsc1209554. - CVE-2025-11234: qemu-kvm: use-after-free in websocket handshake code can lead to denial of service bsc1250984. - CVE-2026-2243: incorrect bounds check leads to heap...

PT-2026-50154

Name of the Vulnerable Software and Affected Versions Deno versions prior to 2.8.1 Description When opening a WebSocket connection, the runtime validates the destination hostname against --deny-net rules but fails to re-verify the IP addresses the hostname resolves to. This allows an...

PT-2026-50131

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 8.5.1 Rocket.Chat versions prior to 8.4.4 Rocket.Chat versions prior to 8.3.6 Rocket.Chat versions prior to 8.2.6 Rocket.Chat versions prior to 8.1.6 Rocket.Chat versions prior to 8.0.7 Rocket.Chat versions prior ...

PT-2026-49760

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.26 Description An authorization bypass exists where a surviving pairing-scoped device session can re-establish node token authority after the token has been revoked. This allows a previously paired device to...

GHSA-XCGM-R5H9-7989 aiohttp: Incomplete websocket frame payloads bypass memory limits

Summary If an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. Impact If a web application has WebSocket endpoints, it may be possible for an attacker to execute a DoS attack through excessive memory use. ----- Patch:...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the websocket checks. An attacker can exhaust system memory by sending large incomplete frame payloads, potentially leading to service disruption. Remediation Upgrade aiohttp to...

aiohttp: Incomplete websocket frame payloads bypass memory limits

Summary If an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. Impact If a web application has WebSocket endpoints, it may be possible for an attacker to execute a DoS attack through excessive memory use. ----- Patch:...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only. Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via permissive user proxy configurations that inclu...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview org.webjars.npm:webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only. Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via permissive user proxy...

0.edsql (>=1.0.49 <=1.0.50), 0xlib (=5.6.6) +7747 more potentially affected by CVE-2026-48779 via ws (>=7.0.0 <=7.5.10)

ws NPM version =7.0.0, =1.0.49, =1.0.0, =0.1.0, =0.0.12, =0.0.12, =0.1.0, =1.0.22, =3.10.1, =0.0.1, =0.0.6 and more Source cves: CVE-2026-48779 Source advisory: SNYK:JS-WS-17344547...

ws: Memory exhaustion DoS from tiny fragments and data chunks

Impact A high volume of exceptionally small fragments and data chunks can be sent by a peer, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process...

org.webjars.npm:angular-websocket (>=2.0.0 <=2.0.1), org.webjars.npm:atmosphere.js (=3.1.3) +39 more potentially affected by CVE-2026-48779 via org.webjars.npm:ws (>=2.0.0-beta.2 <=8.2.3)

org.webjars.npm:ws MAVEN version =2.0.0-beta.2, =2.0.0, =9.3.2, =2.3.0, =6.2.1, =6.2.1, =5.4.6, =0.19.11, =0.2.11, =0.2.19 - org.webjars.npm:github-com-SignalK-signalk-js-client =2.0.3 and more Source cves: CVE-2026-48779 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-17344548...

-fides-amor-et-lux (=1.0.0), -price-checker (>=1.0.0 <=1.0.5) +59934 more potentially affected by CVE-2026-48779 via ws (>=8.0.0 <=8.20.1)

ws NPM version =8.0.0, =1.0.0, =1.0.0, =1.1.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.2.3 - 0g-orbit-cli =0.1.0 - 0g-orbit-core =0.1.0 and more Source cves: CVE-2026-48779 Source advisory: OSV:GHSA-96HV-2XVQ-FX4P...

003-gas-convert (=1.0.1), 0x-hunter-core (>=1.0.0 <=1.0.1-5) +29218 more potentially affected by CVE-2026-48779 via ws (>=1.1.0 <=5.2.2)

ws NPM version =1.1.0, =1.0.0, =0.0.3, =1.1.0, =0.9.9, =1.0.0, =0.0.1, =0.11.3, =0.1.0, =1.0.2, =1.0.7 and more Source cves: CVE-2026-48779 Source advisory: OSV:GHSA-96HV-2XVQ-FX4P...

GHSA-96HV-2XVQ-FX4P ws: Memory exhaustion DoS from tiny fragments and data chunks

Impact A high volume of exceptionally small fragments and data chunks can be sent by a peer, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process...

Asymmetric Resource Consumption (Amplification)

Overview org.webjars.npm:ws is a simple to use websocket client, server and console for node.js. Affected versions of this package are vulnerable to Asymmetric Resource Consumption Amplification when handling a large number of very small fragments and data chunks. An attacker can cause excessive...

7ghost (>=4.11.25 <=4.11.46), @100mslive/hms-excalidraw (>=0.1.3 <=0.1.14) +1243 more potentially affected by CVE-2026-48779 via ws (>=6.0.0 <=6.2.3)

ws NPM version =6.0.0, =4.11.25, =0.1.3, =0.0.1-bate.30, =0.0.1, =0.0.1, =7.0.0, =0.1.0, =4.4.0, =4.2.2, =2.9.0, =0.0.1-alpha.95, =1.0.0, =1.2.0, =1.6.2 and more Source cves: CVE-2026-48779 Source advisory: SNYK:JS-WS-17344547...

-fides-amor-et-lux (=1.0.0), -price-checker (>=1.0.0 <=1.0.5) +59934 more potentially affected by CVE-2026-48779 via ws (>=8.0.0 <=8.20.1)

ws NPM version =8.0.0, =1.0.0, =1.0.0, =1.1.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.2.3 - 0g-orbit-cli =0.1.0 - 0g-orbit-core =0.1.0 and more Source cves: CVE-2026-48779 Source advisory: SNYK:JS-WS-17344547...

0.edsql (>=1.0.49 <=1.0.50), 0xlib (=5.6.6) +7747 more potentially affected by CVE-2026-48779 via ws (>=7.0.0 <=7.5.10)

ws NPM version =7.0.0, =1.0.49, =1.0.0, =0.1.0, =0.0.12, =0.0.12, =0.1.0, =1.0.22, =3.10.1, =0.0.1, =0.0.6 and more Source cves: CVE-2026-48779 Source advisory: OSV:GHSA-96HV-2XVQ-FX4P...

NPM: ws: Memory exhaustion DoS from tiny fragments and data chunks

NPM: ws: Memory exhaustion DoS from tiny fragments and data chunks vulnerability discovered by ? in WordPress Npm ws versions = 1.1.0, 5.2.5...