mod_auth_openidc: mod_auth_openidc: Denial of Service via malformed state cookie parsing

A flaw was found in modauthopenidc, an OpenID Connect Relying Party module for Apache HTTP servers. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request with a malformed state cookie. This can lead to an out-of-bounds read and a one-byte out-of-bounds write...

Important: Red Hat Security Advisory: mod_auth_openidc security update

An update for modauthopenidc is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

CVE-2026-104713: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap a...

CVE-2026-104714: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served request...

PT-2026-106136

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.0 through 2.3.37 Apache Struts versions 2.5.0 through 2.5.33 Apache Struts versions 6.0.0 through 6.11.0 Apache Struts versions 7.0.0 through 7.3.0 Description A race condition occurs when a localized message formats...

CVE-2026-94644

Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94658

Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

Linux Distros Unpatched Vulnerability : CVE-2026-104269

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - modsecurity - None modsecurity-apache - None Ubuntu Linux - GHSA-5pww-8rfg-9crf: RFC 2231 filename parameter bypasses multipart filename rules...

RHEL 10 : mod_auth_openidc (RHSA-2026:75581)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:75581 advisory. The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID...

Linux Distros Unpatched Vulnerability : CVE-2026-104259

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - modsecurity - None modsecurity-apache - None Ubuntu Linux - GHSA-qrch-pjfr-9g47: t:removeComments mishandles the character after a comment...

...[ More ]

Apache Submarine retired to the Apache Attic suffers from an authentication bypass leading to unauthenticated remote code execution. The security filter CommonFilter.isProtectedApi treats any request whose User-Agent header matches the Python SDK pattern as not requiring authentication, and the...

PT-2026-106134

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.5.14 through 2.5.33 Apache Struts versions 6.0.0 through 6.11.0 Apache Struts versions 7.0.0 through 7.3.0 Description An asymmetric resource consumption amplification issue exists when a request parameter is bound to ...

PT-2026-106135

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.1.8 through 2.3.37 Apache Struts versions 2.5.0 through 2.5.33 Apache Struts versions 6.0.0 through 6.11.0 Apache Struts versions 7.0.0 through 7.3.0 Description The REST plugin allows request bodies to be read into...

PT-2026-106133

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.0 through 2.3.37 Apache Struts versions 2.5.0 through 2.5.33 Apache Struts versions 6.0.0 through 6.11.0 Apache Struts versions 7.0.0 through 7.3.0 Description An Expression Language Injection issue exists when the...

CVE-2026-104711: Improper Neutralization of Special Elements used in an Expression Language Statement

Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote co...

CVE-2026-94642

Uncaught exception vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94645

Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94654

Loop with unreachable exit condition 'infinite loop' vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94633

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94636

Improper handling of highly compressed data data amplification, Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...