Security update for pacemaker

This update for pacemaker fixes the following issue CVE-2026-10649: denial of service via integer overflow in remote message decompression bsc1268381. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

SUSE-SU-2026:2742-1 Security update for pacemaker

This update for pacemaker fixes the following issue - CVE-2026-10649: denial of service via integer overflow in remote message decompression bsc1268381...

Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()

...

openSUSE 16: pacemaker / pacemaker-cli / pacemaker-cts / pacemaker-devel / etc (openSUSE-SU-2026:21196-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21196-1 advisory. - CVE-2026-10649: Fixed denial of service via integer overflow in remote message decompression bsc1268381. Tenable has extracted the preceding descripti...

Security update for pacemaker (important)

openSUSE security update: security update for pacemaker ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21196-1 Rating: important References: bsc1268381 Cross-References: CVE-2026-10649 CVSS scores: CVE-2026-10649 SUSE : 7.5...

github.com/sigstore/rekor: Rekor: Denial of Service due to unbounded gzip decompression in Alpine APK parsing

A flaw was found in Rekor. The Package.Unmarshal function, which processes Alpine Package Keep APK files, decompresses gzip streams without limiting the total decompressed size. A remote attacker can exploit this by crafting a malicious APK file with a high compression ratio, causing the server t...

netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression

A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli br, Zstandard zstd, or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an...

PDF components Code Execution

The vulnerability of Google Chrome and Microsoft Edge browsers’ PDF components relates to the possibility of using memory after decompression. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code using a specially created PDF file...

SUSE SLES15: pacemaker / pacemaker-cli / pacemaker-cts / pacemaker-devel / etc (SUSE-SU-2026:2701-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:2701-1 advisory. This update for pacemaker fixes the following issue - CVE-2026-10649: denial of service via integer overflow in remote message decompression bsc1268381...

SUSE SLES15: pacemaker / pacemaker-cli / pacemaker-cts / pacemaker-devel / etc (SUSE-SU-2026:2716-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:2716-1 advisory. This update for pacemaker fixes the following issue - CVE-2026-10649: denial of service via integer overflow in remote message decompression bsc1268381...

Important: Red Hat Security Advisory: vim security update

An update for vim is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...

vim: command injection when decompressing .tgz archives

A flaw was found in Vim. When decompressing .tgz archives, the Vimuntar function builds shell commands using shellescape without the special flag. This allows a specially crafted archive filename to trigger Vim cmdline-special expansion and execute arbitrary commands in the context of the current...

Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing

A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to trigger a denial of service DoS by providing a specially crafted FITS image file. The library's failure to limit the amount of GZIP-compressed data during decoding can lead to unbounded memory...

Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing

A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to trigger a denial of service DoS by providing a specially crafted FITS image file. The library's failure to limit the amount of GZIP-compressed data during decoding can lead to unbounded memory...

Security update for pacemaker

This update for pacemaker fixes the following issues: CVE-2026-10649: Fixed denial-of-service via integer overflow in remote message decompression bsc1268381. Changes for pacemaker: Update to version 2.1.10+20260618.4bca25e3c1: libcrmcommon: Add additional checks to pcmkremotemessagexml...

urllib3: urllib3: Denial of Service due to excessive HTTP response decompression

A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response,...

SUSE CVE-2026-41992

GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression...

SUSE CVE-2026-54250

K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names can be written to...

RHEL 8 : vim (RHSA-2026:34476)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:34476 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: arbitrary command execution via modeline sandbox...

PT-2026-57607

Name of the Vulnerable Software and Affected Versions GNU LibreDWG versions prior to 0.14.8396 Description A heap-based buffer overflow occurs in the R2004 Section Decompression component within the decompress R2004 section function located in the src/decode.c file. This issue can be triggered...