36 matches found
Prototype Pollution
Overview @socket.io/cluster-engine is an A cluster-friendly engine to share load between multiple Node.js processes without sticky sessions Affected versions of this package are vulnerable to Prototype Pollution via client lookup in engine.ts, where session IDs supplied in inter-process messages...
CVE-2026-102600
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...
CVE-2026-102600 Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...
CVE-2026-102600
The @socket.io/cluster-engine component in Socket.IO is vulnerable to a Prototype Pollution flaw prior to version 0.1.1 . The root cause is the use of inherited object properties during the lookup of attacker-controlled session IDs in clustered deployments. By using special property names like __...
CVE-2026-102600 Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...
CVE-2026-102600 Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...
EUVD-2026-88981
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...
[SECURITY] Fedora 45 Update: corosync-3.1.10-8.fc45
This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...
[SECURITY] Fedora 43 Update: corosync-3.1.10-3.fc43
This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...
[SECURITY] Fedora 44 Update: corosync-3.1.10-6.fc44
This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...
The vulnerability of the Corosync cluster engine, which allows a hacker to trigger a service failure
The vulnerability of the Corosync cluster engine is related to incorrect checking of the return value of a function. Exploiting this vulnerability could allow an attacker to cause service failures...
The vulnerability of the Corosync cluster engine, related to integer overflows, allows a attacker to cause a service failure.
The vulnerability of the Corosync cluster engine is related to a numerical overflow condition. Exploiting this vulnerability could allow a remote attacker to cause a service failure...
CVE-2026-17107
A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes RHACM and multicluster-engine MCE. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke...
[SECURITY] Fedora 44 Update: corosync-3.1.10-5.fc44
This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...
[SECURITY] Fedora 42 Update: corosync-3.1.9-4.fc42
This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...
[SECURITY] Fedora 43 Update: corosync-3.1.10-2.fc43
This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...
RLSA-2025:7478 Moderate: corosync security update
The corosync packages provide the Corosync Cluster Engine and C APIs for Rocky Linux cluster software. Security Fixes: corosync: Stack buffer overflow from 'orftokenendianconvert' CVE-2025-30472 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...
Astra Linux – Vulnerability in Corosync
The vulnerability of the coroparse.c component in the Corosync cluster engine is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure...