CentOS Linux 7 [TuxCare] Security Update: spice-server / spice-server-devel (CENTOS7:CLSA-2026:1778489013)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1778489013 advisory. - A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers to cause a denial of service CPU...

AlmaLinux 9.2 [TuxCare] Security Update: patch Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1784720743)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784720743 advisory. - GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handli...

Rocky Linux 9.6 [TuxCare] Security Update: 389-ds-base / 389-ds-base-devel / 389-ds-base-libs / etc (ALMALINUX9.6:CLSA-2026:1782219057)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782219057 advisory. - A flaw was found in 389-ds-base. The getldapmessagecontrolsext function in the LDAP server does not enforce an upper bound on the number ...

Rocky Linux 8 [CIQ] Security Update: jose / jose-debuginfo / jose-debugsource / libjose / etc Multiple Vulnerabilities (crlsa-2024_5294)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20245294 advisory. jose: resource exhaustion CVE-2024-28176 jose: Denial of service due to uncontrolled CPU consumption CVE-2023-50967 Tenable has extracted the preceding...

Rocky Linux 9 [CIQ] Security Update: osbuild-composer / osbuild-composer-core / etc Multiple Vulnerabilities (crlsa-2026_22714)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202622714 advisory. golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61728 golang: net/url: Memory exhaustion in query...

CVE-2026-102990

A flaw was found in basic-ftp. A malicious or compromised FTP server can cause a Denial of Service DoS by returning specially crafted Unix directory listings to the client. Inefficient regular expression processing during directory parsing leads to excessive CPU consumption, blocking the...

EUVD-2026-88537

PyJWT: ReDoS vulnerability when calling the ispemformat function...

OESA-2026-4219 python-sqlparse security update

A non-validating SQL parser. Security Fixes: sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by groupparenthesis and groupcase, causing quadratic CPU...

OESA-2026-4218 python-sqlparse security update

A non-validating SQL parser. Security Fixes: sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by groupparenthesis and groupcase, causing quadratic CPU...

CVE-2026-85532 Apache WSS4J: Insufficient Validation of Derived-Key Parameters

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum leng...

CVE-2026-85532: Improper Input Validation

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum leng...

Linux Distros Unpatched Vulnerability : CVE-2026-102270

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT ispemformat is affected because lazy PEM regular expression backtracks...

AlmaLinux 9.2 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-dnssec-doc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2024:1709547568)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1709547568 advisory. - Certain DNSSEC aspects of the DNS protocol in RFC 4033, 4034, 4035, 6840, and related RFCs allow remote attackers to cause a denia...

Rocky Linux 9.6 [TuxCare] Security Update: osbuild-composer / osbuild-composer-core / osbuild-composer-tests / etc (ALMALINUX9.6:CLSA-2026:1790156031)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790156031 advisory. - Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. CVE-2026-42504 Note that Ness...

Rocky Linux 9.6 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2025:1766138358)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1766138358 advisory. - The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL...

AlmaLinux 9.2 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-libs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2024:1734532058)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1734532058 advisory. - Certain DNSSEC aspects of the DNS protocol in RFC 4033, 4034, 4035, 6840, and related RFCs allow remote attackers to cause a denia...

CentOS Linux 7 [TuxCare] Security Update: unbound / unbound-devel / unbound-libs / unbound-python (CENTOS7:CLSA-2024:1722529717)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1722529717 advisory. - Certain DNSSEC aspects of the DNS protocol in RFC 4033, 4034, 4035, 6840, and related RFCs allow remote attackers to cause a denial of service...

SUSE CVE-2026-102270

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT ispemformat is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, ispemforma...

CVE-2026-67987

crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions in think-tag response parsing on Ruby 3.1.x. A malicious or anomalous model response containing many unterminated tags can cause excessive CPU consumption in t...

CVE-2026-67987

crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions in think-tag response parsing on Ruby 3.1.x. A malicious or anomalous model response containing many unterminated tags can cause excessive CPU consumption in t...