Multiple vulnerabilities impacts AIX due to cURL libcurl

IBM SECURITY ADVISORY First Issued: Mon Sep 21 04:38:42 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/curladvisory12.asc Security Bulletin: Multiple vulnerabilities impacts AIX due to cURL libcurl...

EulerOS 2.0 SP10 : python-requests (EulerOS-SA-2026-3717)

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with...

EulerOS 2.0 SP10 : python-requests (EulerOS-SA-2026-3764)

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with...

Astra Linux – Vulnerability in curl

A authentication bypass vulnerability exists in libcurl prior to v8.0.0. It reuses an previously established SSH connection, even though one SSH option has been modified, which should prevent such reuse. libcurl maintains a pool of previously used connections and can reuse them for subsequent...

CVE-2026-88012

Traefik , the open-source HTTP reverse proxy and load balancer, has a flaw in how HTTP/3 entrypoints handle respondingTimeouts.readTimeout . The timeout is enforced at the TCP layer, but HTTP/3 operates over QUIC , which has no corresponding stream deadline. This means an unauthenticated attacker...

EUVD-2026-75428

Traefik is an HTTP reverse proxy and load balancer. In versions = v2.8.2 through = v3.0.0 through .transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying...

CVE-2026-88878 Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass

Traefik is an HTTP reverse proxy and load balancer. In versions = v2.8.2 through = v3.0.0 through .transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying...

PT-2026-89389

Name of the Vulnerable Software and Affected Versions Traefik versions 2.8.2 through 2.11.55 Traefik versions 3.0.0 through 3.7.11 Description In entry points with HTTP/3 enabled, the respondingTimeouts settings—specifically the readTimeout variable, which defaults to 60 seconds—are not applied t...

PT-2026-89473

Name of the Vulnerable Software and Affected Versions Traefik versions 2.8.2 through 2.11.55 Traefik versions 3.0 through 3.7.11 Description HTTP/3 entrypoints fail to apply the readTimeout setting located in entryPoints..transport.respondingTimeouts.readTimeout. While this timeout is intended to...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: curl (UTSA-2026-106769)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106769 advisory. libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps...

K000163213: libcurl vulnerability CVE-2026-8932

Security Advisory Description libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches t...

org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak

A flaw was found in Apache HttpComponents Client, specifically in its classic input/output I/O model. When processing a response message with an invalid or unsupported Content-Encoding header, the client fails to properly release the underlying network connection. This connection leak can lead to...

CVE-2026-64607

A flaw was found in Apache HttpComponents Client, specifically in its classic input/output I/O model. When processing a response message with an invalid or unsupported Content-Encoding header, the client fails to properly release the underlying network connection. This connection leak can lead to...

curl: 33: CONNECT_ONLY raw I/O selects wrong connection after CURLOPT_SHARE detach (incomplete fix for CVE-2020-8231)

Summary After a completed CURLOPTCONNECTONLY transfer, detaching the shared connection pool via curleasysetopteasy, CURLOPTSHARE, NULL causes curleasysend / curleasyrecv to silently operate on an unrelated connection from a different pool. Data intended for server B is sent to server A, and A's...

CVE-2026-78321

The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling...

CVE-2026-78321 DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion

The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling...

EUVD-2026-64756

The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling...

CVE-2026-78321

The HTTP media server on multiple DJI drone models (including Neo, Flip, Air 3, Avata 2, Mavic 3, Mini 2–5 Pro, and others) lacks sufficient limits on incoming connections and request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeat...

CVE-2026-78321 DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion

The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling...

CVE-2026-78321: Allocation of Resources Without Limits or Throttling

The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling...