518 matches found
Important: Red Hat Security Advisory: mod_auth_openidc security update
An update for modauthopenidc is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...
Important: Red Hat Security Advisory: mod_auth_openidc security update
An update for modauthopenidc is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...
Important: Red Hat Security Advisory: mod_auth_openidc:2.3 security update
An update for the modauthopenidc:2.3 module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common...
Important: Red Hat Security Advisory: mod_auth_openidc:2.3 security update
An update for the modauthopenidc:2.3 module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important...
EulerOS Virtualization 2.12.0 : curl (EulerOS-SA-2026-3634)
According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check...
[SECURITY] [DSA 6504-1] libapache2-mod-auth-openidc security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6504-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 17, 2026 https://www.debian.org/security/faq -...
Debian dsa-6504 : libapache2-mod-auth-openidc - security update
The remote Debian 13 host has a package installed that is affected by a vulnerability as referenced in the dsa-6504 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6504-1 [email protected] https://www.debian.org/security/ Moritz...
CVE-2026-55149
Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the authrequest module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count from an attacker-controlled multipart cookie name and passes the value to makestring, numParts without checking that the value is...
CVE-2026-55149
Vouch Proxy is an SSO and OAuth/OIDC login gateway for Nginx. In versions prior to 0.48.0 (specifically v0.47.2), the Cookie() function in pkg/cookie/cookie.go parses the multipart cookie part count from an attacker-controlled cookie name and passes it unbounded to make([]string, N). A single una...
Astra Linux – Vulnerability in Ruby 2.5
In the CGI gem before version 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service DoS vulnerability. This method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumpti...
Astra Linux – Vulnerability in python-tornado
Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in th...
Astra Linux – Vulnerability in Jetty9
Jetty is a Java-based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or perform unintended behaviors by tampering with the cookie parsing mechanism. If Jetty encounters a cookie value that starts with a double quot...
Astra Linux – Vulnerability in Python-Werkzeug
Werkzeug is a comprehensive WSGI web application library. Browsers may allow “nameless” cookies that look like =value instead of key=value. A vulnerable browser may allow a compromised application on a neighboring subdomain to exploit this to set a cookie like =Host-test=bad for another subdomain...
Security Bulletin: Multiple Vulnerabilities in IBM API Connect
Summary Multiple vulnerabilities were addressed in IBM API Connect version 10.0.8.12 Vulnerability Details CVEID:CVE-2026-2303 DESCRIPTION: The mongo-go-driver repository contains CGo bindings for GSSAPI Kerberos authentication on Linux and macOS. The C wrapper implementation contains a heap...
SUSE CVE-2026-80255
A Set-Cookie: header using tab horizontal tab, ASCII code 9 instead of space ascii code 32 immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host...
EulerOS 2.0 SP12 : curl (EulerOS-SA-2026-3253)
According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables a...
MGASA-2026-0381 Updated apache-mod_auth_openidc packages fix a security vulnerability
Out-of-bounds read and write in state cookie parsing. CVE-2026-54789...
Security update for nodejs20
This update for nodejs20 fixes the following issues: CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request bsc1236258. CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery...
curl: CVE-2026-80255: secure cookie attribute bypass with tab
Summary A Set-Cookie header using HTAB horizontal tab instead of SPACE before the Secure attribute — e.g. Set-Cookie: sid=SECRET;\tSecure — causes curl to store the cookie without its Secure flag. The cookie is then sent over plaintext HTTP on subsequent requests to the same host. The...
CVE-2026-54789 mod_auth_openidc has out-of-bounds read and write in state cookie parsing
modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of...