EUVD-2026-87062

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix tree connection leak in smb2treeconnect See the procedure below: smb2treeconnect ksmbdtreeconnconnect xastore&sess-treeconns, treeconn-id, treeconn ksmbdcounterincKSMBDCOUNTERTREECONNS ksmbdsharetreeconnincsc...

CVE-2026-98162 smb/server: fix tree connection leak in smb2_tree_connect()

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix tree connection leak in smb2treeconnect See the procedure below: smb2treeconnect ksmbdtreeconnconnect xastore&sess-treeconns, treeconn-id, treeconn ksmbdcounterincKSMBDCOUNTERTREECONNS ksmbdsharetreeconnincsc...

Security Bulletin: HttpClient based on the classic i/o model fails to correctly release the underlying connection

Summary HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the...

org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak

A flaw was found in Apache HttpComponents Client, specifically in its classic input/output I/O model. When processing a response message with an invalid or unsupported Content-Encoding header, the client fails to properly release the underlying network connection. This connection leak can lead to...

CVE-2026-90087

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: do not leak an hciconn when a second LE connect is rejected createleconncomplete decides whether the failed connection is still pending by comparing it against hcilookupleconnect, which returns the first LE connection ...

DEBIAN-CVE-2026-90087

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: do not leak an hciconn when a second LE connect is rejected createleconncomplete decides whether the failed connection is still pending by comparing it against hcilookupleconnect, which returns the first LE connection ...

UBUNTU-CVE-2026-85718

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails...

CVE-2026-85718

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails...

EUVD-2026-81908

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails...

CVE-2026-85718: Uncontrolled Resource Consumption

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a client with maxConnections or maxConnectionsPerHost set above zero leaks one connection permit whenever TLS connection establishment fails...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net/smc: fixed the connection leak issue. There is a potential leak issue under the following execution sequence: smcrelease, smcconnectwork if sk-skstate == SMCINIT sendclcconfirim tcpabort; ... sk-skstate = SMCACTIVE...

Security Bulletin:Vulnerability in httpclient5-5.5.jar may affect IBM Infosphere Change Data Capture (CVE-2026-64607)

Summary A security vulnerability has been identified in httpclient5-5.5.jar, Apache HttpComponents Client. httpclient5-5.5.jar is used by IBM Infosphere Change Data Capture. IBM has addressed this vulnerability. Refer to the "Remediation/Fixes" section below for remediation details. Vulnerability...

SUSE-SU-2026:4028-1 Security update for httpcomponents-client

This update for httpcomponents-client fixes the following issue: - CVE-2026-64607: improper release of underlying connection back to connection manager when an invalid or unsupported Content-Encoding header value in a response message bsc1273163...

org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak

A flaw was found in Apache HttpComponents Client, specifically in its classic input/output I/O model. When processing a response message with an invalid or unsupported Content-Encoding header, the client fails to properly release the underlying network connection. This connection leak can lead to...

Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1)

An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available RHBQ 3.33.3.SP1.The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.Red Hat Product...

CVE-2026-64607

A flaw was found in Apache HttpComponents Client, specifically in its classic input/output I/O model. When processing a response message with an invalid or unsupported Content-Encoding header, the client fails to properly release the underlying network connection. This connection leak can lead to...

CVE-2026-59654

Apache CloudStack's scoped global configuration functionality suffers from a resource leak (database connections not released after their effective lifetime), affecting modules such as Quota and Host-HA on the management server. Over time, the accumulated leak can lead to an eventual denial of se...

CVE-2026-59654 Apache CloudStack: DoS caused by database connections leak

Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service DoS scenari...

CVE-2026-59654 Apache CloudStack: DoS caused by database connections leak

Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service DoS scenari...

PYSEC-2026-3709

Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are...