CentOS Linux 7 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ldap / etc Multiple Vulnerabilities (CENTOS7:CLSA-2024:1722003981)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2024:1722003981 advisory. - Substitution encoding issue in modrewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories...

Rocky Linux 8 [CIQ] Security Update: httpd / httpd-debuginfo / httpd-debugsource / httpd-devel / etc (crlsa-2026_64794)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202664794 advisory. httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in modldap per-directory configuration CVE-2026-29167 Tenable has...

CVE-2026-56153: Out-of-bounds Write

Out-of-bounds Write vulnerability in Apache HTTP Server's modcharsetlite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

CVE-2026-94269: Use of Non-Canonical URL Paths for Authorization Decisions

Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX. In some configurations where a permissive route overlaps a protected one, a crafted encoded path can reach an upstream endpoint that the matched route's policies were never meant to cover. A request that...

Apache httpd -- Multiple vulnerabilities

The Apache httpd project reports: limited RCE for some internal redirects to non-CGI files in CGI directories CVE-2026-42356 low moddav shared lock overflow CVE-2026-42528 moderate modheartmonitor denial of service CVE-2026-46729 low modsession: Session cookie not removed during internal redirect...

CVE-2025-24813

CVE-2025-24813 — Apache Tomcat 部分 PUT デシリアライゼーション RCE 深刻度: クリティカル CVSS 9.8 認証要否: 不要 影響を受けるバージョン: Apache Tomcat 9.0.0.M1 – 9.0.98 / 10.1.0-M1 – 10.1.34 / 11.0.0-M1 – 11.0.2 修正済み: Tomcat 9.0.99 / 10.1.35 / 11.0.3 仕組み Apache Tomcat は 部分 PUT Content-Range によるチャンクアップロード をサポートしています。 部分 PUT が到着すると、Tomca...

Security Bulletin: IBM Tivoli Netcool Impact is vulnerable to Improper Encoding due to Apache Log4j (CVE-2026-49844)

Summary Apache Log4j is shipped with IBM Tivoli Netcool Impact as part of its logging infrasture. Information about a security vulnerability affecting Apache Log4j has been published in a security bulletin. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite...

CLEANSTART-2025-RL13274 Apache Ant 1

Security vulnerability affects the apache-ant package. Apache Ant 1...

CLEANSTART-2025-TN67221 As mitigation for CVE-2020-1945 Apache Ant 1

Security vulnerability affects the apache-ant package. As mitigation for CVE-2020-1945 Apache Ant 1...

CLEANSTART-2025-KO30612 When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs

Security vulnerability affects the apache-ant package. When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs...

CLEANSTART-2025-YD79563 When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs

Security vulnerability affects the apache-ant package. When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs...

Security Bulletin: Vulnerabilities in Netty,Apache Log4j Core,Spring Boot,Spring Framework,PostCSS,tmp,Spring Data,Apache Commons Lang,React Router,Bootstrap,d3-color might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty, Apache Log4j Core, Spring Boot, Spring Framework, PostCSS, tmp, Spring Data, Apache Commons Lang, React Router, Bootstrap,d3-color. Vulnerabilities include The attacker can present a server certificate...

CVE-2026-94029

A flaw was found in Apache MINA SSHD. When processing SSH File Transfer Protocol SFTP check-file extensions, the server accumulates file hash verification responses entirely in memory without enforcing a size limit. An authenticated remote attacker can exploit this vulnerability by requesting fil...

Security Bulletin: Vulnerabilities in Netty,Spring Boot,ZDRES-232,Apache HttpComponents,Spring Security,PostCSS,spring-cloud-gateway-server might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty, Spring Boot, ZDRES-232, Apache HttpComponents,Spring Security, PostCSS,spring-cloud-gateway-server. Vulnerabilities include attacker supplies com.myapp.SomeClass causes clinit of SomeClass â€" and many...

CVE-2026-94002

A flaw was found in the sshd-sftp component of Apache MINA SSHD. This vulnerability allows a malicious server to cause a Denial of Service DoS on the client by exhausting system memory. The SFTP SSH File Transfer Protocol client fails to verify whether incoming replies correspond to previously se...

CVE-2026-93994

A flaw was found in Apache MINA SSHD. When the server is configured to require multiple Secure Shell SSH public keys for authentication, it fails to verify that the submitted keys are distinct. A remote user can exploit this flaw by presenting the same public key twice to satisfy multi-key...

SUSE CVE-2026-77185

Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain presumed rare way to implement an SSH server. Apache MINA SSHD is a Java library for client- and server-side SSH. In the server part of the library, a mechanism to perform...

SUSE CVE-2026-93994

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshdconfig AuthenticationMethods "publickey,publickey"...

SUSE CVE-2026-93995

Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD...

SUSE CVE-2026-93996

Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol ...