nginx: NGINX ngx_http_core_module vulnerability

A flaw was found in NGINX. In certain configurations using asynchronous file I/O and SSI pages with include virtual commands, request processing can access freed memory in a worker process. A remote attacker may trigger memory corruption or a worker crash. Arbitrary code execution may be possible...

Use-after-free when using asynchronous file I/O (AIO)

Use-after-free when using asynchronous file I/O AIO Severity: medium CVE-2026-97205 Not vulnerable: 1.31.7+, 1.30.6+ Vulnerable: 0.8.11-1.31.6...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop in the handling of server responses when using asynchronous multi-handles with interactive protocols such as FTP, IMAP, POP3, or SMTP. An attacker can cause the process to enter an infinite loop by continuously streaming...

GHSA-494H-XX7X-5FRH Microsoft Security Advisory CVE-2026-70183 - ASP.NET Core Security Feature Bypass Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Components.Authorization. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A stale...

kernel: xfrm: hold dev ref until after transport_finish NF_HOOK

A flaw was found in the Linux kernel's xfrm IP eXtensible FRamework subsystem. This vulnerability involves a race condition where a network device's reference is released too early during packet processing after asynchronous cryptography. This premature release can lead to the system attempting t...

tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing

A flaw was found in Apache Tomcat. Incorrect object recycling and reuse during the HTTP/2 processing of asynchronous servlets can cause requests and responses to be mixed up between different users. A remote attacker could exploit this vulnerability to trigger unintended data cross-over,...

ROS-20261012-73-0095

The vulnerability of the functions pcryptaeaddone, pcryptaeadenc, and pcryptaeaddec in the crypto/pcrypt.c module of the Linux operating system is related to errors in handling asynchronous cryptographic requests. Exploiting this vulnerability can allow a remote attacker to compromise the...

Fixed in Apache Tomcat 10.1.61

Important: HTTP/2 request/response mix-up after error during async processing CVE-2026-101356 Incorrect object recycling and re-use affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This was fixed with commit 6c7da608. This issue was...

Fixed in Apache Tomcat 9.0.123

Important: HTTP/2 request/response mix-up after error during async processing CVE-2026-101356 Incorrect object recycling and re-use affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This was fixed with commit 4b1eb9a1. This issue was...

masscan

MASSCAN: Escáner de puertos IP masivo Este es un escáner de puertos a escala de Internet. Puede escanear todo Internet en menos de 5 minutos, transmitiendo 10 millones de paquetes por segundo, desde una sola máquina. Su uso parámetros, salida es similar a nmap, el escáner de puertos más famoso. E...

bscan

:mag: una herramienta asíncrona de enumeración de objetivos :magright: Sinopsis bscan es una utilidad de línea de comandos para realizar recolección activa de información y enumeración de servicios. En esencia, bscan lanza de forma asíncrona procesos de utilidades de escaneo bien conocidas,...

SUSE CVE-2026-98359

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Reject unregistering netdevs in ibgetethspeed ibdevicegetnetdev intentionally returns a referenced netdevice even when it is unregistering, so matching and cleanup callers can still find the association. The reference...

Security Bulletin: Multiple Vulnerabilities affects IBM Data Studio Client 4.2.3

Summary Security Fix of multiple Vulnerabilities of IBM Data Studio Client 4.2.3. The vulnerabilities have been addressed in 4.2.3 version. Hence, IBM strongly recommends upgrading to 4.2.3. Vulnerability Details CVEID:CVE-2026-18401 DESCRIPTION: The non-blocking asynchronous JSON parser in...

CVE-2026-98359

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA subsystem. When an asynchronous RDMA port query retrieves link speed settings, the kernel fails to verify whether the associated network device is being unregistered before invoking its operations. A local user could exploit...

kernel: xfrm: hold dev ref until after transport_finish NF_HOOK

A flaw was found in the Linux kernel's xfrm IP eXtensible FRamework subsystem. This vulnerability involves a race condition where a network device's reference is released too early during packet processing after asynchronous cryptography. This premature release can lead to the system attempting t...

UBUNTU-CVE-2026-98359

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Reject unregistering netdevs in ibgetethspeed ibdevicegetnetdev intentionally returns a referenced netdevice even when it is unregistering, so matching and cleanup callers can still find the association. The reference...

CVE-2026-98266

In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix potential UAF after asynchronous card release Usually a sound driver releases the resources assigned to the card via sndcardfree, and it synchronizes with the whole release procedure. However, when the card is...

CVE-2026-57554

Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations...

PT-2026-106356

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Memory corruption occurs when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations. FastRPC is a remote procedur...

Astra Linux – Vulnerability in python-tornado

Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and earlier use an inefficient algorithm when parsing parameters for HTTP header values, which may lead to Denial-of-Service attacks. The parseparam function in httputil.py is used to parse specific HTTP header...