34522 matches found
BIT-TOMCAT-2022-25762 Response mix-up with WebSocket concurrent send and close
If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling...
SUSE-SU-2026:1940-1 Security update for curl
This update for curl fixes the following issues: Security issues fixed: - CVE-2026-4873: connection reuse ignores TLS requirement bsc1262631. - CVE-2026-5545: wrong reuse of HTTP Negotiate connection bsc1262632. - CVE-2026-6253: proxy credentials leak over redirect-to proxy bsc1262635. -...
[SECURITY] Fedora 42 Update: pgbouncer-1.25.2-1.fc42
pgbouncer is a lightweight connection pooler for PostgreSQL and uses libevent for low-level socket handling...
CVE-2025-56352: Uncontrolled Resource Consumption
In tinyMQTT commit 6226ade15bd4f97be2d196352e64dd10937c1962 2024-02-18, the broker mishandles protocol violations during CONNECT packet parsing. When receiving a CONNECT packet with a zero-length Client ID while CleanSession is set to 0, the broker correctly replies with a CONNACK return code 0x0...
CVE-2025-56352
The tinyMQTT broker (commit 6226ade15bd4f97be2d196352e64dd10937c1962) contains a resource management vulnerability due to improper protocol handling during CONNECT packet parsing . Specifically, when the broker receives a CONNECT packet with a zero-length Client ID and CleanSession set to 0, it f...
curl: Connection reuse ignores haproxyprotocol and HAPROXY_CLIENT_IP settings, allowing PROXY context to persist across transfers
Summary: libcurl's connection pool match logic does not include the CURLOPTHAPROXYPROTOCOL setting or the CURLOPTHAPROXYCLIENTIP value in its connection match key. Two transfers issued through the same Curleasy or via a shared connection cache CURLLOCKDATACONNECT therefore share one TCP connectio...
Denial Of Service
github.com/hashicorp/boundary is vulnerable to denial of service. The vulnerability is due to improper handling of TLS handshakes during worker node enrollment, where an attacker can delay or withhold the client certificate to block connection handling, allowing legitimate worker connections to b...
Improper Handling Of The HTTP Connection Header
@fastify/reply-from and @fastify/http-proxy are vulnerable to Improper Handling of the HTTP Connection Header. The vulnerability is due to processing the client-supplied Connection header after proxy-added headers have been inserted, which allows an attacker to selectively remove security, routin...
MSC-2025-11353
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Suspect publisher – this publisher has a history ...
MSC-2025-11108
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...
CLSA-2026-1778889816 curl: Fix of CVE-2026-5545
CVE-2026-5545: wrong reuse of HTTP Negotiate connection; only allow an existing connection to be reused and "upgraded" to NTLM when neither NTLM nor Negotiate authentication is in flight on it...
CVE-2021-47959 WordPress Plugin WPGraphQL 1.3.5 Denial of Service
WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending batched GraphQL queries with duplicated fields. Attackers can send POST requests to the GraphQL endpoint with amplified field duplication payloa...
Key Exchange without Entity Authentication
Overview Affected versions of this package are vulnerable to Key Exchange without Entity Authentication in the tunnel.Start process. An attacker can intercept and manipulate HTTP requests and responses by performing a man-in-the-middle attack on the SSH connection. This is only exploitable if the...
CVE-2026-43322
A flaw was found in the Bluetooth Host Controller Interface HCI synchronization module hcisync of the Linux kernel. A use-after-free UAF vulnerability exists in the lereadfeaturescomplete function, where a freed hciconn object is accessed. This can allow an attacker to cause a system crash, leadi...
python: Fix of 4 CVEs
CVE-2019-9740: reject control characters in HTTP URL paths in httplib.HTTPConnection.putrequest to prevent CRLF header injection - CVE-2019-18348: reject control characters in hostnames in httplib.HTTPConnection.init via a new validatehost helper to prevent CRLF header injection the glibc...
EUVD-2026-28814
Amazon Redshift Vulnerable to Remote Code Execution via Unsafe Class Loading...
curl: TLS peer-verification bypass via mid-transfer ssl_config mutation
Hi all, We want to report a TLS peer-verification issue on current master. The trigger is narrow and requires a specific application usage pattern, but when it fires, a transfer that requests CURLOPTSSLVERIFYPEER=1 can reuse a TLS connection that was established with peer verification disabled...
curl: HTTPS proxy connection reuse lets one easy handle inherit another handle's mTLS-authenticated proxy session
Summary: libcurl can reuse an already mTLS-authenticated HTTPS proxy TLS connection for a different easy handle even when that second handle does not have the proxy private key required to establish the session itself. The issue happens because the HTTPS proxy connection reuse identity does not...
