undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service...

RLSA-2026:69125 Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-8932 curl: curl: Information...

PT-2026-96806

Name of the Vulnerable Software and Affected Versions SLC8000 versions prior to 9.7.0.3 SLC9000 versions prior to 9.7.0.2 EMG8500/EMG7500 versions prior to 9.7.0.1 SLB882 affected versions not specified Description A server-side request forgery SSRF issue exists in the WebSSH/WebTelnet listener...

CVE-2026-96259: Server-Side Request Forgery (SSRF)

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal network addresses and read the responses via the...

Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification

Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14, 3.4.0–3.4.15 fix 3.4.16, 3.3.0–3.3.18 fix 3.3.19, 2.7.0–2.7.32 fix 2.7.33; Cassandra SSL...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-090052)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090052 advisory. In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection...

AlmaLinux 9 : curl (ALSA-2026:69126)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:69126 advisory. curl: libcurl: Unauthorized connection reuse due to a logical error CVE-2026-8458 curl: Information disclosure due to uncleared proxy authentication stat...

RockyLinux 9 : curl (RLSA-2026:69126)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69126 advisory. curl: libcurl: Unauthorized connection reuse due to a logical error CVE-2026-8458 curl: Information disclosure due to uncleared proxy authentication sta...

Linux Distros Unpatched Vulnerability : CVE-2026-85718

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a...

PT-2026-97044

Name of the Vulnerable Software and Affected Versions s2n-quic versions prior to 1.89.0 Description Improper validation of the Destination Connection ID length allows an unauthenticated remote user to cause a denial of service by shutting down a server endpoint using a single crafted UDP datagram...

PT-2026-97057

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.7.0 through 11.7.10 Mattermost versions 11.8.0 through 11.8.5 Mattermost versions 11.9.0 through 11.9.1 Mattermost versions 11.10.0 through 11.10.1 Description The software fails to apply the internal-connection filter t...

CVE-2026-80231

A flaw was found in libcurl. This vulnerability allows libcurl to incorrectly reuse an existing HTTPS connection for a given hostname, even when a different Native CA Store setting CURLSSLOPTNATIVECA is specified for the new connection. This could potentially lead to a client trusting a malicious...

SUSE CVE-2026-88008

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend accepts h2c and returns 101 Switching...

SUSE CVE-2026-88012

Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection and the HTTP/3 server has no corresponding QUIC stream...

CVE-2026-62987 Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In...

CVE-2026-62987 Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In...

CVE-2026-62987 Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In...

CVE-2026-62987

Fabio (an HTTP/S and TCP router for Consul-managed applications) versions 1.6.6 through 1.7.2 contain an incomplete fix for CVE-2025-48865 . The protectHeaders logic in proxy/http_headers.go covers a hardcoded set of forwarded headers but omits operator-configured ClientIPHeader , TLSHeader , and...

curl: libcurl: Unauthorized connection reuse due to a logical error

A flaw was found in libcurl. A logical error in the connection pooling mechanism may cause libcurl to reuse an authenticated connection for an unintended service. This could allow an application to wrongfully reuse an existing connection to the same server that was authenticated for a different...

Important: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...